Wompi Payment Integration CVE-2026-103312

Exploitable only on a stock/default installation where the Wompi merchant secret has NOT yet been manually configured - in that state the callback checksum is keyed on an empty secret, so an unauthenticated remote attacker can forge a payment notification and mark an arbitrary order as paid. The primary limiting factor is configuration: once the operator sets a non-empty merchant secret (as a functioning store processing real payments would normally do), checksum verification succeeds and the forgery is rejected. No authentication (PR:N) and no user interaction (UI:N) are required against a vulnerable, unconfigured install.

Signals point to a modest, conditional risk rather than an urgent priority. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - network-reachable, low-complexity, unauthenticated, with impact limited to integrity (I:L) and no confidentiality or availability effect. EPSS is low at 0.17% (7th percentile), consistent with no observed widespread exploitation. The vulnerability is NOT listed in CISA KEV, so there is no public evidence of active exploitation. No PoC or exploit reference appears in the provided references (only a WPScan advisory and the NVD detail page), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', indicating a routine patch cadence rather than emergency action. The single most important caveat is in the description itself: exploitation only works on a 'stock install' where the merchant secret is still empty/unconfigured; once an operator configures the Wompi merchant secret (which a live store collecting real payments would normally need to do), the checksum verification functions and the forgery is blocked. This makes the realistic attack surface narrower than the AV:N/PR:N vector alone suggests - the CVSS vector and the description are consistent, but the 'stock install' precondition materially limits real-world risk and is not reflected in the base score.

An attacker targets a WordPress store running the Wompi payment plugin that has been installed but not yet configured with a merchant secret. The attacker sends a forged payment-notification callback to the plugin's endpoint; because the checksum is keyed on an empty secret, the forged notification passes verification and an arbitrary order is marked as paid, letting the attacker obtain goods or services without payment. No public exploit code is identified in the provided data, and no authentication or user interaction is required.