Authentication Bypass in Payment Integration Wompi Plugin from WordPress
CVE-2026-103312
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 October 2026
Badges
What is CVE-2026-103312?
The Payment Integration Wompi plugin for WordPress, prior to version 4.0.1, is susceptible to an authentication bypass vulnerability. The plugin fails to confirm the authenticity of incoming payment notifications due to an unconfigured merchant secret, resulting in an unsecured checksum for callbacks. This critical oversight allows unauthenticated attackers to exploit the system by fabricating payment notifications and fraudulently marking orders as paid, potentially leading to significant revenue loss for merchants.
Affected Version(s)
Payment Integration Wompi 0 <= 4.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.