CVE-2026-103308

Deferred Deferred - Pending Action

Unauthenticated Payment Status Manipulation in Visma Pay for WooCommerce

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103308

EUVD

EUVD-2026-100975

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Visma	Pay for WooCommerce 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

The Visma Pay for WooCommerce WordPress plugin before version 1.2.2 has a flaw where it does not properly verify payment gateway return requests. This flaw allows unauthenticated attackers to mark any order as paid without needing valid credentials. Additionally, attackers can access sensitive customer data such as names, email addresses, and postal addresses from any order.

Detection Guidance

Check if the Visma Pay for WooCommerce plugin version is below 1.2.2. Inspect network traffic for unauthorized payment status changes or customer data requests. Look for logs showing empty merchant secrets in payment gateway responses.

Impact Analysis

This vulnerability can lead to financial losses if attackers mark orders as paid without actual payment. It also risks exposing customer personal data, which could result in privacy breaches and potential legal consequences for businesses using the plugin.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR due to unauthorized access to personal data. It may also violate HIPAA if customer data is exposed, as HIPAA requires protection of protected health information.

Mitigation Strategies

Upgrade the Visma Pay for WooCommerce plugin to version 1.2.2 or later immediately. Ensure merchant secrets are properly configured and not left empty. Monitor orders for unauthorized status changes and customer data disclosures.

Hi! I’m here to help you understand CVE-2026-103308. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70