CVE-2026-103671
Received
Received - Intake
External Control of Web Parameter in EC-CUBE AmazonPay Plugin
Vulnerability report for CVE-2026-103671, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: JPCERT/CC
Description
Description
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| EC-CUBE | CO.,LTD. | AmazonPay V2 Plugin (4.0/4.1 series) v1.1.7 |
| EC-CUBE | CO.,LTD. | AmazonPay V2 Plugin (4.0/4.1 series) v1.0.0 |
| EC-CUBE | CO.,LTD. | AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition) v4.3.1 |
| EC-CUBE | CO.,LTD. | AmazonPay V2 Plugin (4.2/4.3 series) v4.2.3 |
| EC-CUBE | CO.,LTD. | AmazonPay V2 Plugin (4.2/4.3 series) v4.2.0 |
| EC-CUBE | CO.,LTD. | AmazonPay Plugin (4.0 series) 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-472 | The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. |
