Visma Pay WooCommerce CVE-2026-103308

Exploitation requires the target store to be running Visma Pay for WooCommerce before 1.2.2 AND to have an empty merchant secret - i.e., a store that has not yet entered its payment credentials - because the plugin verifies return requests against that (empty) secret. When this holds, no authentication, user interaction, or special network position is needed (AV:N/AC:L/PR:N/UI:N): a remote unauthenticated attacker can forge gateway return requests. The primary limiting factor is the credential state: stores that have fully configured a non-empty merchant secret are not described as exploitable in the same manner, which narrows realistic targets to newly-installed, misconfigured, test, or abandoned deployments.

This is a medium-severity (CVSS 6.5) authentication/authorization flaw in a regional WooCommerce payment plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation, which is consistent with the description's 'unauthenticated attackers' and the forged-return-request mechanism. Publicly available exploit code exists (reported by WPScan), which raises practical risk above a theoretical finding. However, this is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. The real-world priority is tempered by two factors: the limited blast radius (C:L/I:L, no availability impact, scope unchanged) and the gating precondition that the store has not entered its payment credentials (empty merchant secret). A fully configured store with a non-empty secret may not be exploitable in the same way, so this skews toward newly-installed, test, or abandoned stores rather than all deployments. Net: a credible, POC-backed fraud/PII risk worth patching promptly for anyone running the plugin, but not a mass-exploitation emergency on the available data.

An attacker identifies a store running Visma Pay for WooCommerce that has not completed credential configuration (empty merchant secret), then sends a forged payment-gateway return request that the plugin fails to authenticate. Because a POC is publicly available via WPScan, the attacker can reliably mark their own fraudulent orders as paid to obtain goods for free, and can iterate over order identifiers to disclose the name, email, and postal address of other customers. The attack is remote, unauthenticated, and low-complexity per the CVSS vector.