CVE-2026-103376
Received Received - Intake

Information Disclosure in PeachPay for WooCommerce

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: WPScan

Description
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-103376
EUVD
EUVD-2026-103255

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) 1.117.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the PeachPay WordPress plugin allows unauthenticated users to retrieve secret keys for any paid order. The plugin fails to check user permissions or ownership before exposing these keys, which can then be used to access sensitive customer information such as names, email addresses, postal addresses, and order contents.

Detection Guidance

Check if your PeachPay plugin version is between 1.117.9 and 1.120.69. Inspect server logs for unauthenticated requests to order endpoints that return secret keys. Test by attempting to access order details via API or direct URL without authentication.

Impact Analysis

If you use the affected PeachPay plugin versions, attackers could exploit this flaw to steal customer data from your orders. This includes personal details and purchase history, potentially leading to privacy breaches, identity theft, or misuse of customer information.

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data without authorization. Organizations using the plugin may face compliance violations, legal penalties, and reputational damage due to unauthorized data disclosure.

Mitigation Strategies

Update the PeachPay plugin to version 1.120.70 or later immediately. If updating is not possible, disable the plugin until the update is applied. Review server logs for signs of exploitation and restrict access to order endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart