All vulnerabilities
CVE-2026-103332

Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key

Unknown Payex Payment Gateway for WoocommerceNetwork & edge
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.

Text from CVE List

Affected versions 1

  • Payex Payment Gateway for Woocommerceaffected: all versions through 1.2.10CVE List

References 1