CVE-2026-103382
Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.
| Vendor | unknown |
| Product | casso flow |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown casso flow
Be the first to know when new medium vulnerabilities affecting unknown casso flow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Casso Flow
0 < 4.2.0
References
Credits
Pedro Pinho WPScan