CVE-2026-103327
Received Received - Intake

CryptoCloud WordPress Plugin Payment Notification Authentication Bypass

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: WPScan

Description
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-103327
EUVD
EUVD-2026-115720

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown CryptoCloud 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The CryptoCloud WordPress plugin versions 3.0.0 to 3.0.1 has a flaw where it does not verify the authenticity of payment notifications from its gateway callback. This happens because the integrity check is skipped when the webhook secret is left at its default empty value. As a result, unauthenticated attackers can forge payment notifications to mark orders as paid or failed without any actual payment being made.

Detection Guidance

Check if the CryptoCloud WordPress plugin version is between 3.0.0 and 3.0.1. Inspect the plugin files for an empty webhook secret in the gateway callback settings. Look for unauthorized order status changes without corresponding payments.

Impact Analysis

This vulnerability allows attackers to manipulate order statuses without making payments, potentially leading to financial losses for businesses using the plugin. It could also disrupt order processing and damage customer trust due to incorrect order confirmations.

Mitigation Strategies

Update the CryptoCloud plugin to the latest version beyond 3.0.1. Set a strong, non-default webhook secret in the plugin settings. Monitor order statuses for unauthorized changes and review payment logs for anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103327. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...