MEDIUM 5.3 NVD

CVE-2026-103313

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor v

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.

References

https://wpscan.com/vulnerability/feaebdbf-cfa2-49cf-a8be-d2f22b0ad9c9/

Published: 2026-10-28 · Source: NVD · Feed updated: 2026-10-28

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-28 via NVD.

vulnfeed aggregates 14962 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.