CVE-2026-103361
Received Received - Intake

Authentication Bypass in Valitor WooCommerce Plugin

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: WPScan

Description
The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-103361
EUVD
EUVD-2026-125978

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Payment Gateway via Valitor for WooCommerce From 0 (inc) to 1.9.41 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Payment Gateway via Valitor for WooCommerce WordPress plugin before version 1.9.41. It fails to properly validate payment callbacks because it uses a hard-coded default verification secret shared by all installations that haven't changed it. Attackers can exploit this to forge payment confirmations and mark orders as paid without actual payment.

Detection Guidance

Check the installed version of the Payment Gateway via Valitor for WooCommerce plugin. If it is below 1.9.41, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep valitor in the WordPress directory.

Impact Analysis

Unauthenticated attackers could trick your system into marking orders as paid without receiving payment. This could lead to financial losses as legitimate customers receive products without payment, while you believe the transactions were completed.

Compliance Impact

This vulnerability could violate compliance requirements related to financial transaction integrity and data protection. For example, GDPR may require secure payment processing, and HIPAA may mandate accurate financial records. Exploitation could lead to non-compliance penalties.

Mitigation Strategies

Update the Payment Gateway via Valitor for WooCommerce plugin to version 1.9.41 or later immediately. If updating is not possible, manually change the verification secret to a unique, strong value to prevent unauthorized payment confirmations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103361. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...