CVE-2026-103313
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Oct 28, 2026
CISA due date
—
The record
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-345
- CVE-2026-119289 Zuke is a code-first, strongly typed build automation system for Deno. CWE-345
- CVE-2026-119422 Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that… CWE-345
- CVE-2026-93008 A flaw was found in dnsmasq. CWE-345
- CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator… CWE-345
- CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled… CWE-345
- CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper… CWE-345
- CVE-2026-103330 The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the… CWE-345