CVE-2026-103376: PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check

Q: Which deployments are affected?

PeachPay versions 1.117.9 through 1.120.69 are affected. Versions before 1.120.70 do not perform the required capability or ownership check for the vulnerable status-check request.

Q: What does an attacker need to exploit this issue?

An attacker can make an unauthenticated request and does not need account capabilities or ownership of the target order. The issue permits retrieval of the secret key for any paid order.

Q: What information can be exposed after an order key is retrieved?

The disclosed key can be used to view the order's customer name, email address, postal address, and order contents.

Q: How can I determine whether my site may be exposed?

Verify the installed PeachPay version and whether the site has paid orders. Installations running a version from 1.117.9 through 1.120.69 may expose secret keys for those orders.

Published Oct 17, 2026

Updated

The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.

Affected Software

1 affected component

Peachpay PeachPay — Payments & Express Checkout for WooCommerce<1.120.70

Event History

Oct 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

PeachPay versions 1.117.9 through 1.120.69 are affected. Versions before 1.120.70 do not perform the required capability or ownership check for the vulnerable status-check request.

What does an attacker need to exploit this issue?

An attacker can make an unauthenticated request and does not need account capabilities or ownership of the target order. The issue permits retrieval of the secret key for any paid order.

What information can be exposed after an order key is retrieved?

The disclosed key can be used to view the order's customer name, email address, postal address, and order contents.

How can I determine whether my site may be exposed?

Verify the installed PeachPay version and whether the site has paid orders. Installations running a version from 1.117.9 through 1.120.69 may expose secret keys for those orders.

CVE-2026-103376: PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information can be exposed after an order key is retrieved?

How can I determine whether my site may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information can be exposed after an order key is retrieved?

How can I determine whether my site may be exposed?