CVE-2026-103517: Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Airwallex Online Payments Gatewayto a version that resolves this vulnerability.Fixed in 1.36.0
Event History
Frequently Asked Questions
Which sites are exposed to forged payment notifications?
Sites using an affected version of the Airwallex Online Payments Gateway WordPress plugin are exposed when no webhook secret is configured. In that configuration, the plugin does not verify that payment notifications originate from the payment provider.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They can forge a payment notification to mark an order as paid without making a payment.
What should be prioritized for mitigation?
Upgrade the plugin to version 1.36.0 or later. If upgrading cannot happen immediately, configure a webhook secret so incoming payment notifications can be verified.