Telcell Payment Gateway CVE-2026-103301

Exploitable against default configurations because the notification-signing secret is empty by default, so an attacker can compute a 'valid' signature without knowing any secret - no authentication, user interaction, or non-default setup is required. The specific prerequisites are: the Payment Gateway for Telcell plugin at a version before 2.0.5 is active, WooCommerce is in use, and the plugin's payment-notification/callback endpoint is network-reachable. The main limiting factor is that an administrator who has manually configured a non-empty signing secret would break the trivial forgery; otherwise the only practical constraint is the small deployment footprint of this regional gateway.

This is a genuine but moderate-severity business-logic flaw, not a critical mass-exploitation threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) is internally consistent with the description: remote, unauthenticated, no user interaction, low integrity impact and no confidentiality or availability impact. The core weakness - an empty default signing secret allowing forged payment notifications - means exploitation is trivial against any default installation, so attack complexity is correctly Low. A public exploit exists (WPScan), raising practical risk above the raw score. However, key triage signals are MISSING: no EPSS score and no KEV listing were provided, so there is no evidence of widespread or active exploitation; POC availability is NOT equivalent to active exploitation. The real-world risk is tightly bounded by prevalence - this is a niche regional (Telcell/Armenian) payment gateway plugin, so the absolute population of exploitable sites is small. Net: prioritize patching on any affected store because the financial-fraud impact (goods shipped against unpaid orders) is direct, but this is not a broad-internet emergency. Note the input 'Information Disclosure' tag conflicts with the actual impact, which is integrity/order-state manipulation, not disclosure (C:N in the vector confirms no confidentiality loss).

An attacker identifies a WooCommerce store running the Telcell gateway with the default (empty) secret, places an order, then sends a forged payment-notification request with a valid signature computed against the empty secret, flipping the order to 'paid' so goods or services are released without payment. A public proof-of-concept from WPScan demonstrates the forgery, and the same handler can be abused to mark a victim's chosen order 'failed' with an invalid signature. Because the flaw is network-reachable and unauthenticated with low complexity, no special tooling or access is needed.