CVE-2026-103375: Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data Disclosure

Q: Who is exposed to this issue?

Sites running the Antom Payments WordPress plugin version 2.0.11 or earlier are affected. Because the confirmation link is returned without ownership or authorization checks, unauthenticated visitors can exploit the issue.

Q: What information could an attacker access?

An attacker can obtain an order confirmation link containing the order's secret key and use it to view customer order details. Exposed information includes the customer's name, address, phone number, and email address.

Q: What must an attacker know or do to exploit it?

The issue can be exploited without authentication. The available data indicates that an attacker needs to target an order confirmation link or order, but does not specify how order identifiers are discovered or enumerated.

Published Nov 8, 2026

Updated

The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order details, including name, address, phone number and email.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Sites running the Antom Payments WordPress plugin version 2.0.11 or earlier are affected. Because the confirmation link is returned without ownership or authorization checks, unauthenticated visitors can exploit the issue.

What information could an attacker access?

An attacker can obtain an order confirmation link containing the order's secret key and use it to view customer order details. Exposed information includes the customer's name, address, phone number, and email address.

What must an attacker know or do to exploit it?

The issue can be exploited without authentication. The available data indicates that an attacker needs to target an order confirmation link or order, but does not specify how order identifiers are discovered or enumerated.

CVE-2026-103375: Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data Disclosure

Event History

Frequently Asked Questions

Who is exposed to this issue?

What information could an attacker access?

What must an attacker know or do to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What information could an attacker access?

What must an attacker know or do to exploit it?