CVE-2026-105970
BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
What each source reports
CVE List No score
BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
- Record
CVE-2026-105970- Updated
- 2026-11-08
GitHub AdvisoriesGHSA-xvqw-hjj4-j538 No score
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify...
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
- Record
GHSA-xvqw-hjj4-j538- Updated
- 2026-11-08
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-105970 is a vulnerability with no CVSS score yet in Unknown Thanh Toán Quét Mã Qr Code Tự Động, published November 8, 2026. No source lists public exploit code. No source names a fixed version.