Authentication Bypass in Payex Payment Gateway for Woocommerce Plugin
CVE-2026-103332
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-103332?
The Payex Payment Gateway for WooCommerce plugin, specifically version 1.2.10, contains a significant vulnerability due to inadequate verification of incoming payment notifications. An empty validation secret by default allows unauthenticated attackers to forge valid payment confirmations. This can result in any order being marked as paid, posing a serious risk for merchants relying on the plugin for transaction processing.
Affected Version(s)
Payex Payment Gateway for Woocommerce 0 <= 1.2.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.