All vulnerabilities
CVE-2026-103324

Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

Unknown Cardinity Payment Gateway for WooCommerceNetwork & edge
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.4.2Fixed versionCVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 3.4.2Cardinity Payment Gateway for WooCommerceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.

Text from CVE List

Affected versions 1

  • Cardinity Payment Gateway for WooCommerceaffected: 3.2.6 before 3.4.2CVE List

References 1