Payment Notification Forgery in UniPAY Gateway for WooCommerce by WordPress
CVE-2026-103331
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-103331?
The UniPAY Payment Gateway for WooCommerce plugin fails to adequately verify payment notifications. This vulnerability arises because the plugin checks the notification signatures against a merchant secret that is empty by default, leaving it vulnerable to exploitation. As a result, unauthenticated attackers can forge payment notifications, potentially marking arbitrary orders as legitimate and resulting in unauthorized financial transactions.
Affected Version(s)
UniPAY Payment Gateway For WooCommerce 0 <= 2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.