CVE-2026-103324— Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret
Quick assessment
Affected
Unknown Cardinity Payment Gateway for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WooCommerce 的 Cardinity Payment Gateway 插件（版本低于 3.4.2）未能正确验证其所接收支付通知的真实性，因为用于签署这些通知的默认密钥为空。这导致未经身份验证的攻击者可以伪造已批准支付的通知，将任意订单标记为已支付，或强制将其标记为失败。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Cardinity Payment Gateway for WooCommerce | 3.2.6< 3.4.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103324
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret
Source: CVE Program / CVE List V5
Vulnerability Description
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Cardinity Payment Gateway for WooCommerce | 3.2.6 ~ 3.4.2 | - |
|
II. Public POCs for CVE-2026-103324
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103324
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-15 · 9 CVEs total
| CVE-2026-92429 | 5.3 MEDIUM | Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via ma |
| CVE-2026-92428 | 5.3 MEDIUM | Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Fail |
| CVE-2026-96537 | Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite | |
| CVE-2026-74920 | Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute | |
| CVE-2026-109145 | User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Regist | |
| CVE-2026-106031 | Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result | |
| CVE-2026-104643 | Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide UR | |
| CVE-2026-103304 | eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-110527
WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creat -
CVE-2026-97314
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affi -
CVE-2026-81344
Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object -
CVE-2026-81343
Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated AC -
CVE-2026-106470
WP Data Access < 5.5.88 - Subscriber+ SSRF
V. Comments for CVE-2026-103324
No comments yet