CVE-2026-94299: elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure a non-empty shared secret before trusting incoming payment notification (IPN callback) requests; do not leave the secret at its default empty value.
elegro Crypto Payment WordPress plugin shared secret = non-empty value
Event History
Frequently Asked Questions
Which installations are exposed?
Installations of the elegro Crypto Payment WordPress plugin through version 1.0.1 are exposed if the shared secret used for payment notifications remains at its default empty value.
What does an attacker need to exploit this issue?
An attacker does not need authentication when the shared secret is empty. They can forge payment notification requests to confirm payments and change the status of arbitrary orders.
What can be done while awaiting an update?
Configure a non-empty shared secret for payment notifications so incoming requests are not trusted with the default empty value.