CVE-2026-103312
Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.
| Vendor | unknown |
| Product | payment integration wompi |
| Published | Oct 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown payment integration wompi
Be the first to know when new unknown vulnerabilities affecting unknown payment integration wompi are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Payment Integration Wompi
0 ≤ 4.0.1
References
Credits
Naoki Kawahigashi WPScan