medium5.3
CVE-2026-103298
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the pay…
Impact
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
Affected products
| Product | Affected versions |
|---|---|
| CCAvenue Payment Gateway For WooCommerce WordPress Plugin | through 3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.