CVE-2026-103313
BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
| Vendor | unknown |
| Product | bitpay gateway for woocommerce |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown bitpay gateway for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown bitpay gateway for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / BitPay Gateway for WooCommerce
0 ≤ 4.1.3
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan