CCAvenue Payment Gateway CVE-2026-103298

The store must run the CCAvenue Payment Gateway for WooCommerce plugin (version 3.1 or earlier) with the CCAvenue callback active, and critically the verification key must be empty - which is the state on a default install, so default configurations are exploitable with no authentication, no user interaction, and only a crafted request to the confirmation endpoint. The practical limiting factors are: an order must exist (or be created) to target; a merchant who has populated the underlying value so the derived verification key is non-empty would not be in the vulnerable default state; and exploitation is confined to falsifying order payment status (integrity), not data theft or outage.

This is a moderate-severity access-control flaw (CWE-284) with a confirmed network, low-complexity, unauthenticated attack surface per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), but a deliberately scoped impact: integrity-only, low (I:L), with no confidentiality or availability effect (C:N/A:N), yielding the 5.3 base score. The signals are internally consistent - the description's 'unauthenticated attackers can forge a confirmation' matches PR:N/UI:N, and the fact that the verification key is empty on a default install explains the low attack complexity (AC:L). No EPSS score was provided, and the vulnerability is NOT listed in CISA KEV, so there is no evidence of active exploitation; a public PoC reference exists but is not verified as working exploit code, so exploitability in practice is plausible but unproven. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a real-but-not-urgent priority. The key tension is that the raw 5.3 'medium' score understates the business impact: the flaw enables payment fraud (orders marked paid without payment), which for an affected merchant is a direct financial-loss integrity issue even though CVSS caps it at I:L. Treat this as a genuine priority for any store actually running this plugin, moderated by the plugin's narrow deployment footprint.

An attacker places (or targets) an order on a WooCommerce store using the CCAvenue gateway, then sends a forged payment-confirmation request directly to the plugin's callback endpoint. Because the plugin does not verify the request originates from CCAvenue and its verification key is empty on a default install, the forged confirmation is accepted and the order is marked paid without any real payment. A public PoC reference (WPScan) exists but is not verified as working exploit code.