Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103312— Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback

Quick assessment

Affected
Unknown Payment Integration Wompi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Payment Integration Wompi WordPress 插件在 4.0.1 及以下版本中，默认安装时无法验证 incoming 支付通知的真实性。这是因为回调函数的校验和（checksum）依赖于商户密钥，而该密钥在用户手动配置之前为空。此缺陷允许未认证的攻击者伪造支付通知，并将任意订单标记为已支付。

AI Predicted 8.1 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103312

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback
Source: CVE Program / CVE List V5
Vulnerability Description
The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Payment Integration Wompi 0 ~ 4.0.1 -

II. Public POCs for CVE-2026-103312

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103312

请登录查看更多情报信息。

Other References for CVE-2026-103312 (1)

Same Patch Batch · Unknown · 2026-10-27 · 4 CVEs total

CVE-2026-103359 5.3 MEDIUM PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via
CVE-2026-103325 3.7 LOW TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via We
CVE-2026-103332 Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation For

IV. Related Vulnerabilities

Same vendor: Unknown