CVE-2026-103372: Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure

Q: Who is exposed to this issue?

Sites using Payconiq for WooCommerce versions through 1.0.4 are affected. The disclosure applies to paid orders, and recent guest orders may expose customer personal details.

Q: What does an attacker need to exploit it?

No authentication is required. An attacker can obtain the key for any paid order because the plugin does not verify that the visitor is authorized to view that order.

Q: How can we tell whether we may be affected?

Check whether Payconiq for WooCommerce is installed and whether its version is 1.0.4 or earlier. Review whether the store has paid orders, particularly recent guest orders, because those are described as potentially exposing customer details.

Published Oct 28, 2026

Updated

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.

Affected Software

1 affected component

Payconiq Payconiq for WooCommerce<=1.0.4

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using Payconiq for WooCommerce versions through 1.0.4 are affected. The disclosure applies to paid orders, and recent guest orders may expose customer personal details.

What does an attacker need to exploit it?

No authentication is required. An attacker can obtain the key for any paid order because the plugin does not verify that the visitor is authorized to view that order.

How can we tell whether we may be affected?

Check whether Payconiq for WooCommerce is installed and whether its version is 1.0.4 or earlier. Review whether the store has paid orders, particularly recent guest orders, because those are described as potentially exposing customer details.

CVE-2026-103372: Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can we tell whether we may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can we tell whether we may be affected?