UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-103298
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-10-26T11:05:33.130612+00:00
- Cve id
- CVE-2026-103298
- First seen by Signal
- 2026-10-26T11:03:13+00:00
- Retrieved at
- 2026-10-26T11:07:52+00:00
- Published at
- 2026-10-26T07:17:06.743
- Last modified
- 2026-10-26T07:17:06.743
Explore deeper with Ninja Signal's threat intelligence graph