CVE-2026-103359
Medium · 5.3CVSS
5.3
EPSS
0.1%
Published
Oct 27, 2026
CISA due date
—
The record
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-345
- CVE-2026-119289 Zuke is a code-first, strongly typed build automation system for Deno. CWE-345
- CVE-2026-119422 Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that… CWE-345
- CVE-2026-93008 A flaw was found in dnsmasq. CWE-345
- CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator… CWE-345
- CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled… CWE-345
- CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper… CWE-345
- CVE-2026-103330 The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the… CWE-345