UNKNOWN NVD

CVE-2026-103319

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider,

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

References

https://wpscan.com/vulnerability/c07f15a0-3c15-429f-bcde-1511ad658c6c/

Published: 2026-10-26 · Source: NVD · Feed updated: 2026-10-26

This unknown severity vulnerability was published on 2026-10-26 via NVD.

vulnfeed aggregates 18201 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.