CVE-2026-103375
Received Received - Intake

Unauthenticated Order Details Exposure in Antom Payments WordPress Plugin

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: WPScan

Description
The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order details, including name, address, phone number and email.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-103375
EUVD
EUVD-2026-119465

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Antom Payments From 0 (inc) to 2.0.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Antom Payments WordPress plugin up to version 2.0.11. It allows unauthenticated attackers to access sensitive WooCommerce order data by exploiting missing ownership or authorization checks before displaying an order's confirmation link, which contains a secret key.

Detection Guidance

Check if the Antom Payments WordPress plugin is installed and verify its version. If it is version 2.0.11 or lower, the system is vulnerable. Inspect network traffic for unauthorized access to order confirmation links containing secret keys.

Impact Analysis

Attackers can view customer details such as names, addresses, phone numbers, and emails from any order. This exposes sensitive personal and financial data, potentially leading to identity theft, fraud, or privacy violations for both customers and the business using the plugin.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and failure to protect user information. It may also breach HIPAA if it involves protected health information. Non-compliance could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Update the Antom Payments plugin to the latest version immediately. If an update is not available, consider disabling the plugin temporarily until a patch is released. Review all exposed order data and notify affected customers if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...