CVE-2026-106027
Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.
| Vendor | unknown |
| Product | oxygen mydata for woocommerce |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown oxygen mydata for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown oxygen mydata for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Oxygen MyData for WooCommerce
3.0.0 < 3.0.9
References
Credits
Naoki Kawahigashi WPScan