CVE-2026-103301

Deferred Deferred - Pending Action

Authentication Bypass in Telcell WordPress Payment Gateway

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-103301

EUVD

EUVD-2026-107142

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Payment Gateway for Telcell	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Payment Gateway for Telcell WordPress plugin before version 2.0.5. It allows unauthenticated attackers to forge payment notifications because the secret used to sign them is empty by default. This lets attackers mark arbitrary WooCommerce orders as paid without verification. The same handler can also mark an attacker-chosen order as failed by providing an invalid signature.

Detection Guidance

Check if the Payment Gateway for Telcell WordPress plugin version is below 2.0.5. Inspect plugin files for empty merchant secret configurations or unauthenticated payment notification handlers.

Impact Analysis

This vulnerability could allow attackers to trick the system into marking orders as paid without actual payment, leading to financial losses. It may also enable attackers to falsely mark orders as failed, causing legitimate transactions to be rejected.

Compliance Impact

This vulnerability could lead to unauthorized transactions being marked as paid, potentially violating data integrity and access control requirements under GDPR and HIPAA. Unauthorized order modifications may expose sensitive payment or personal data, risking non-compliance with privacy and security controls.

Mitigation Strategies

Update the Payment Gateway for Telcell plugin to version 2.0.5 or later immediately. Ensure the merchant secret is configured and not empty to prevent forgery of payment notifications.

Hi! I’m here to help you understand CVE-2026-103301. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...