LOW 3.7 NVD

CVE-2026-103325

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signa

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.

References

https://wpscan.com/vulnerability/d19c174c-0032-4f5d-b9be-c4f690e4c8ca/

Published: 2026-10-27 · Source: NVD · Feed updated: 2026-10-27

This low severity vulnerability with a CVSS score of 3.7 was published on 2026-10-27 via NVD.

vulnfeed aggregates 18707 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.