CVE-2026-103313— BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler

Quick assessment

Affected

Unknown BitPay Gateway for WooCommerce

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WooCommerce 的 BitPay Gateway WordPress 插件（版本 4.1.3 及以下）未将支付提供商的交易确认信息与对应的订单进行绑定，也未对已确认的金额进行验证。这使得未认证的攻击者能够利用其持有的单个真实低价值交易，将任意高价值订单标记为已支付。

CVSS 5.3 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler

Source: CVE Program / CVE List V5

Vulnerability Description

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	BitPay Gateway for WooCommerce	0 ~ 4.1.3	-

II. Public POCs for CVE-2026-103313

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-103313

请登录查看更多情报信息。

Other References for CVE-2026-103313 (1)

https://wpscan.com/vulnerability/feaebdbf-cfa2-49cf-a8be-d2f22b0ad9c9/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-103313

Same Patch Batch · Unknown · 2026-10-28 · 42 CVEs total

CVE-2026-110508	5.3 MEDIUM	Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypas
CVE-2026-106648	5.3 MEDIUM	Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vi
CVE-2026-103330	5.3 MEDIUM	Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature
CVE-2026-115223	4.9 MEDIUM	Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
CVE-2026-110524		Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode
CVE-2026-103331		UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via
CVE-2026-110509		Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via
CVE-2026-107100		Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclos
CVE-2026-110506		Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
CVE-2026-110292		PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Can
CVE-2026-110507		Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop
CVE-2026-106002		Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
CVE-2026-106003		Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion
CVE-2026-106647		Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget
CVE-2026-107098		Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widge
CVE-2026-107097		Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection vi
CVE-2026-103382		Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confi
CVE-2026-103688		Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
CVE-2026-105972		WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribu
CVE-2026-105997		Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipie

Showing top 20 of 42 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown