CVE-2026-103325
Received Received - Intake

TiendaCrypto WooCommerce Plugin Webhook Signature Validation Flaw

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: WPScan

Description
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-103325
EUVD
EUVD-2026-110632

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown TiendaCrypto para WooCommerce 1.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The TiendaCrypto para WooCommerce WordPress plugin through version 1.2.1 has a flaw where it does not properly verify the authenticity of payment webhook requests. The plugin checks the request signature against an empty key, allowing attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid if the server preserves request header case.

Detection Guidance

Check if the TiendaCrypto para WooCommerce plugin version is between 1.0.1 and 1.2.1. Inspect webhook requests for missing or empty HMAC signature validation. Monitor WooCommerce orders marked as paid without corresponding transactions.

Impact Analysis

This vulnerability allows unauthenticated attackers to forge payment notifications, causing the plugin to incorrectly mark orders as paid. This could lead to financial losses for merchants if fraudulent orders are processed without actual payment.

Mitigation Strategies

Update the plugin to the latest version if available. Disable the plugin if no update is provided. Implement additional server-side validation for payment webhooks. Monitor order statuses for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103325. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart