CVE-2026-103324
Deferred Deferred - Pending Action

Cardinity Payment Gateway for WooCommerce Authentication Bypass via Empty Secret

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: WPScan

Description
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-103324
EUVD
EUVD-2026-101860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Cardinity Payment Gateway for WooCommerce 3.2.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Cardinity Payment Gateway for WooCommerce plugin before version 3.4.2 has a flaw where the secret used to verify payment notifications is empty by default. This allows unauthenticated attackers to forge payment notifications, marking orders as paid or forcing them into a failed state without proper verification.

Detection Guidance

Check the installed version of the Cardinity Payment Gateway for WooCommerce plugin. If it is between 3.2.6 and 3.4.1, the system is vulnerable. Verify if the project secret is empty or improperly configured in the plugin settings.

Impact Analysis

Attackers could exploit this to trick the system into processing fake payments, leading to financial losses or incorrect order statuses. Merchants using the vulnerable plugin may unknowingly fulfill orders that were never paid or incorrectly mark paid orders as failed.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications to payment statuses. Forcing orders into paid or failed states without authentication may lead to improper financial processing, which could violate data integrity and security requirements under these regulations.

Mitigation Strategies

Update the Cardinity Payment Gateway for WooCommerce plugin to version 3.4.2 or later immediately to patch the vulnerability. Ensure the project secret is properly configured and not left empty.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart