CVE-2026-103361: Payment Gateway via Valitor for WooCommerce < 1.9.41 - Unauthenticated Payment Bypass via a Shipped Default Verification Code

Q: Which stores are exposed to unauthenticated payment confirmation forgery?

Stores running a version earlier than 1.9.41 are exposed if they have not changed the plugin's shipped default verification secret. The shared default value is used to validate payment callbacks.

Q: What does an attacker need to exploit this issue?

An attacker can exploit the issue without authentication by forging a payment callback that uses the default verification secret. Successful exploitation can mark arbitrary orders as paid.

Q: How can I determine whether my store may be affected?

Check whether the Payment Gateway via Valitor for WooCommerce plugin version is earlier than 1.9.41 and whether its payment callback verification secret remains set to the shipped default. Stores meeting both conditions may accept forged payment confirmations.

Q: What can be done if updating is not immediately possible?

Change the plugin's verification secret from the shipped default value to a unique secret. Review orders marked paid for unexpected payment confirmations.

Published Nov 15, 2026

Updated

The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.

Affected Software

1 affected component

wordpress/payment-gateway-via-valitor-for-woocommerce<1.9.41

Event History

Nov 15, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Which stores are exposed to unauthenticated payment confirmation forgery?

Stores running a version earlier than 1.9.41 are exposed if they have not changed the plugin's shipped default verification secret. The shared default value is used to validate payment callbacks.

What does an attacker need to exploit this issue?

An attacker can exploit the issue without authentication by forging a payment callback that uses the default verification secret. Successful exploitation can mark arbitrary orders as paid.

How can I determine whether my store may be affected?

Check whether the Payment Gateway via Valitor for WooCommerce plugin version is earlier than 1.9.41 and whether its payment callback verification secret remains set to the shipped default. Stores meeting both conditions may accept forged payment confirmations.

What can be done if updating is not immediately possible?

Change the plugin's verification secret from the shipped default value to a unique secret. Review orders marked paid for unexpected payment confirmations.

CVE-2026-103361: Payment Gateway via Valitor for WooCommerce < 1.9.41 - Unauthenticated Payment Bypass via a Shipped Default Verification Code

Affected Software

Event History

Frequently Asked Questions

Which stores are exposed to unauthenticated payment confirmation forgery?

What does an attacker need to exploit this issue?

How can I determine whether my store may be affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which stores are exposed to unauthenticated payment confirmation forgery?

What does an attacker need to exploit this issue?

How can I determine whether my store may be affected?

What can be done if updating is not immediately possible?