Authentication Bypass in CCAvenue Payment Gateway for WooCommerce Plugin
CVE-2026-103298
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 October 2026
Badges
What is CVE-2026-103298?
The CCAvenue Payment Gateway for WooCommerce plugin fails to confirm the authenticity of payment-confirmation requests from the payment provider. This vulnerability arises because the verification key used in the payment process is derived from an empty value during standard installations. As a result, unauthorized attackers can exploit this weakness to create fake payment confirmations, allowing them to mark WooCommerce orders as paid without genuine transactions. This flaw underscores the importance of implementing reliable verification methods for payment gateways to safeguard against fraudulent activities.
Affected Version(s)
CCAvenue Payment Gateway for WooCommerce 0 <= 3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.