CVE-2026-103671: Medium severity EC-CUBE AmazonPay Plugin vulnerability
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
Affected Software
Event History
Frequently Asked Questions
Who can be targeted by this issue?
Users going through the ordering process in an EC-CUBE 4 series deployment using the AmazonPay Plugin may be targeted. Exploitation requires the user to interact with the attacker-controlled redirect.
What can an attacker do if exploitation succeeds?
An attacker can redirect the user to an arbitrary website during ordering. This may enable collection of the user's account information.
Does exploitation require authentication or complex attack conditions?
The supplied vector indicates network-based exploitation with low attack complexity and no privileges required. User interaction is required.