CVE-2026-103382: Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation

Q: Which sites are exposed by the default configuration?

Sites running a version of the Casso Flow WordPress plugin before 4.2.0 are exposed if they retain the default empty token configuration. The flaw can be used against pending WooCommerce orders regardless of the payment method selected for the order.

Q: What does an attacker need to exploit this issue?

An attacker does not need authentication. They need to forge an incoming bank-transfer payment notification for a pending WooCommerce order.

Q: How can I determine whether an order may have been affected?

Review pending WooCommerce orders that were changed to paid status and compare those changes with expected payment evidence. The provided information does not identify a specific log entry or indicator for forged notifications.

Published Oct 28, 2026

Updated

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.

Affected Software

1 affected component

Casso Casso Flow WordPress plugin<4.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Casso Flow WordPress plugin to a version that resolves this vulnerability.
Fixed in 4.2.0

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed by the default configuration?

Sites running a version of the Casso Flow WordPress plugin before 4.2.0 are exposed if they retain the default empty token configuration. The flaw can be used against pending WooCommerce orders regardless of the payment method selected for the order.

What does an attacker need to exploit this issue?

An attacker does not need authentication. They need to forge an incoming bank-transfer payment notification for a pending WooCommerce order.

How can I determine whether an order may have been affected?

Review pending WooCommerce orders that were changed to paid status and compare those changes with expected payment evidence. The provided information does not identify a specific log entry or indicator for forged notifications.

CVE-2026-103382: Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed by the default configuration?

What does an attacker need to exploit this issue?

How can I determine whether an order may have been affected?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed by the default configuration?

What does an attacker need to exploit this issue?

How can I determine whether an order may have been affected?