CVE-2026-105970: BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation
Published Nov 8, 2026
·Updated
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
Event History
Nov 8, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description