CVE-2026-103300
Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
| Vendor | unknown |
| Product | eurobank woocommerce payment gateway |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown eurobank woocommerce payment gateway
Be the first to know when new medium vulnerabilities affecting unknown eurobank woocommerce payment gateway are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Eurobank WooCommerce Payment Gateway
0 ≤ 2.1.1
References
Credits
Naoki Kawahigashi WPScan