CVE-2026-103301
Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.
| Vendor | unknown |
| Product | payment gateway for telcell |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown payment gateway for telcell
Be the first to know when new medium vulnerabilities affecting unknown payment gateway for telcell are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Payment Gateway for Telcell
0 < 2.0.5
References
Credits
Naoki Kawahigashi WPScan