CVE-2026-103324
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
| Vendor | unknown |
| Product | cardinity payment gateway for woocommerce |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown cardinity payment gateway for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown cardinity payment gateway for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Cardinity Payment Gateway for WooCommerce
3.2.6 < 3.4.2
References
Credits
Naoki Kawahigashi WPScan