{"id":"CVE-2026-103299","aliases":["EUVD-2026-109622","GHSA-3fmh-h32q-9jjr"],"status":"published","title":"nexi Alpha Bank for WooCommerce \u003c= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret","description":"The Payment Gateway  WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00182,"percentile":0.07832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-10-26T06:00:18Z","modified":"2026-10-30T21:33:09Z","products":[{"vendor":"unknown","product":"payment gateway"}],"references":[{"url":"https://wpscan.com/vulnerability/0a1c3070-181d-49ea-9488-d0d7e4be419c/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103299"},{"url":"https://wpscan.com/vulnerability/0a1c3070-181d-49ea-9488-d0d7e4be419c"},{"url":"https://github.com/advisories/GHSA-3fmh-h32q-9jjr"}],"sources":{"cve":[{"id":"CVE-2026-103299","title":"nexi Alpha Bank for WooCommerce \u003c= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret","description":"The Payment Gateway  WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.","status":"published","published":"2026-10-26T06:00:18.758Z","modified":"2026-10-30T20:00:58.487Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-109622","description":"The Payment Gateway  WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.","status":"published","published":"2026-10-26T06:00:18Z","modified":"2026-10-30T20:00:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:01.965054Z"}],"ghsa":[{"id":"GHSA-3fmh-h32q-9jjr","title":"The Payment Gateway  WordPress plugin through 2.2.0 does not ensure a shared secret is configured...","description":"The Payment Gateway  WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.","status":"published","published":"2026-10-26T09:31:05Z","modified":"2026-10-30T21:33:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:14:53.220001Z"}],"nvd":[{"id":"CVE-2026-103299","description":"The Payment Gateway  WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.","status":"published","published":"2026-10-26T07:17:06.87Z","modified":"2026-10-30T20:16:52.05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:13:03.126833Z"}]}}