medium6.5
CVE-2026-103308
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret t…
Impact
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
Affected products
| Product | Affected versions |
|---|---|
| Visma Pay For WooCommerce WordPress Plugin | before 1.2.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.