All vulnerabilities
CVE-2026-103325

TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass

Unknown TiendaCrypto para WooCommerce
Open in ThreatlineRecord JSON
CVSS
3.7Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.

Text from CVE List

Affected versions 1

  • TiendaCrypto para WooCommerceaffected: 1.0.1 through 1.2.1CVE List

References 1