CVE-2026-103671
Deferred Deferred - Pending Action

External Control of Web Parameter in EC-CUBE AmazonPay Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: JPCERT/CC

Description
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-11-08
AI Q&A
2026-10-15
EPSS Evaluated
2026-11-07
NVD
CVE-2026-103671
EUVD
EUVD-2026-100939

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-472 The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an external control of assumed-immutable web parameter issue in the EC-CUBE AmazonPay Plugin. It allows attackers to redirect users to arbitrary websites during the ordering process, potentially exposing user account information.

Detection Guidance

Check if your EC-CUBE installation uses the vulnerable AmazonPay Plugin versions (v1.0.0 to v1.1.12 for 4.0/4.1 series, v4.2.0 to v4.3.1 for 4.2/4.3 series, or v1.3.0 and earlier for 4.0 series). Inspect plugin files in the EC-CUBE directory for AmazonPay-related files and verify version numbers in configuration or plugin metadata.

Impact Analysis

An attacker could exploit this to redirect you to a malicious site during checkout, potentially stealing your account details or other sensitive information. This could lead to unauthorized access to your account or financial data.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations may face compliance breaches if user data is exposed.

Mitigation Strategies

Update the AmazonPay Plugin to the latest patched version immediately. For older versions (v1.2.9 or earlier), migrate to the CV2-compatible AmazonPay V2 Plugin. If using EC-CUBE cloud version, confirm it is already patched. Disable the plugin temporarily if an update is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...