CVE-2026-106027: Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback

Published Nov 12, 2026

Updated

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Oxygen MyData for WooCommerce versions 3.0.0 through 3.0.8 are affected. Version 3.0.9 is identified as the first version not affected by this issue.

Does an attacker need an account or valid payment callback credentials?

No. The affected payment callback lacks proper authorization and does not validate request authenticity, so an unauthenticated user can exploit it.

What can exploitation allow?

An attacker can mark arbitrary WooCommerce orders as completed through the affected EveryPay status callback.

CVE-2026-106027: Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback

Event History

Frequently Asked Questions

Which installations are affected?

Does an attacker need an account or valid payment callback credentials?

What can exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does an attacker need an account or valid payment callback credentials?

What can exploitation allow?