CVE-2026-103671

Deferred Deferred - Pending Action

External Control of Web Parameter in EC-CUBE AmazonPay Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: JPCERT/CC

Description

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103671

EUVD

EUVD-2026-100939

Affected Vendors & Products

Vendor	Product	Version / Range
EC-CUBE	CO.,LTD.	AmazonPay V2 Plugin (4.0/4.1 series) v1.1.7
EC-CUBE	CO.,LTD.	AmazonPay V2 Plugin (4.0/4.1 series) v1.0.0
EC-CUBE	CO.,LTD.	AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition) v4.3.1
EC-CUBE	CO.,LTD.	AmazonPay V2 Plugin (4.2/4.3 series) v4.2.3
EC-CUBE	CO.,LTD.	AmazonPay V2 Plugin (4.2/4.3 series) v4.2.0
EC-CUBE	CO.,LTD.	AmazonPay Plugin (4.0 series) 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-472	The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Attack-Flow Graph

Executive Summary

This vulnerability is an external control of assumed-immutable web parameter issue in the EC-CUBE AmazonPay Plugin. It allows attackers to redirect users to arbitrary websites during the ordering process, potentially exposing user account information.

Detection Guidance

Check if your EC-CUBE installation uses the vulnerable AmazonPay Plugin versions (v1.0.0 to v1.1.12 for 4.0/4.1 series, v4.2.0 to v4.3.1 for 4.2/4.3 series, or v1.3.0 and earlier for 4.0 series). Inspect plugin files in the EC-CUBE directory for AmazonPay-related files and verify version numbers in configuration or plugin metadata.

Impact Analysis

An attacker could exploit this to redirect you to a malicious site during checkout, potentially stealing your account details or other sensitive information. This could lead to unauthorized access to your account or financial data.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations may face compliance breaches if user data is exposed.

Mitigation Strategies

Update the AmazonPay Plugin to the latest patched version immediately. For older versions (v1.2.9 or earlier), migrate to the CV2-compatible AmazonPay V2 Plugin. If using EC-CUBE cloud version, confirm it is already patched. Disable the plugin temporarily if an update is not immediately possible.

Hi! I’m here to help you understand CVE-2026-103671. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70