External Control of Immutable Web Parameter in EC-CUBE Plugin by EC-CUBE
CVE-2026-103671

5.3MEDIUM

Key Information:

Vendor

Ec-cube Co.,ltd.

Status
Amazonpay V2 Plugin (4.0/4.1 Series)
Amazonpay V2 Plugin (4.2/4.3 Series, Bundle Edition)
Amazonpay V2 Plugin (4.2/4.3 Series)
Amazonpay Plugin (4.0 Series)
Vendor
CVE Published:
14 October 2026

What is CVE-2026-103671?

A vulnerability exists in the AmazonPay Plugin for the EC-CUBE 4 series that allows external control of an assumed-immutable web parameter. This flaw can be exploited to redirect users to an arbitrary website during the ordering process, posing a significant risk of exposing sensitive account information.

Affected Version(s)

AmazonPay Plugin (4.0 series) 0

AmazonPay V2 Plugin (4.0/4.1 series) v1.1.7

AmazonPay V2 Plugin (4.0/4.1 series) v1.0.0

References

https://www.ec-cube.net/news/detail.php?news_id=490
https://jvn.jp/en/jp/JVN43511918/

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.