PULSE
ES
FEED
ransomdirewolf reclama a GRUPO PETROIL · MX · Energy & Utilitiesransombooba project reclama a RCOA- Regent Christian Online Academy · CA · Educationransombooba project reclama a Kerckstede vzw · BE · Otherransombooba project reclama a BASS Medical Group · US · Healthcareransombooba project reclama a Hudson River Museum · US · Educationransombooba project reclama a Horizon Eye Specialists & LASIK Center · US · Healthcareransombooba project reclama a Aesthetic Specialty Centre · PK · Healthcareransombooba project reclama a City of Big Spring · US · Government & Defenseransombooba project reclama a KING FAMILY MEDICAL · US · Healthcareransombooba project reclama a Charter Township of Commerce · US · Government & Defenseransombooba project reclama a Regent Christian Online Academy · CA · Educationransomaurora reclama a GreenbergFarrow · Professional Servicesransomwallstreet reclama a Bristol City Council · GB · Government & Defenseransomqilin reclama a NuVista Federal Credit Union · US · Financial Servicesransomdirewolf reclama a GRUPO PETROIL · MX · Energy & Utilitiesransombooba project reclama a RCOA- Regent Christian Online Academy · CA · Educationransombooba project reclama a Kerckstede vzw · BE · Otherransombooba project reclama a BASS Medical Group · US · Healthcareransombooba project reclama a Hudson River Museum · US · Educationransombooba project reclama a Horizon Eye Specialists & LASIK Center · US · Healthcareransombooba project reclama a Aesthetic Specialty Centre · PK · Healthcareransombooba project reclama a City of Big Spring · US · Government & Defenseransombooba project reclama a KING FAMILY MEDICAL · US · Healthcareransombooba project reclama a Charter Township of Commerce · US · Government & Defenseransombooba project reclama a Regent Christian Online Academy · CA · Educationransomaurora reclama a GreenbergFarrow · Professional Servicesransomwallstreet reclama a Bristol City Council · GB · Government & Defenseransomqilin reclama a NuVista Federal Credit Union · US · Financial Services
← All CVEs
CVE WatchOct 26, 2026

CVE-2026-103299

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's

CVSS

—

No CVSS

EPSS

0.1%

p3

KEV

—

Exploit Today

1

0-100

Published: Oct 26, 2026 · Last modified: Oct 26, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

Official references
Related CVEs

No related CVEs by CWE or product.