TiendaCrypto WooCommerce CVE-2026-103325

Exploitation requires that the plugin's payment webhook endpoint be reachable and, critically, that the web server preserve the case of request header names - the description explicitly scopes the attack to 'web servers that preserve request header case,' which is the primary limiting factor and the basis for AC:H. No authentication is required (PR:N) and no user interaction is needed (UI:N); the signature check is defeated because the plugin validates against a key that is always empty. The attack is limited to TiendaCrypto para WooCommerce versions 1.0.1 through 1.2.1 and impacts only order payment status (integrity), with no data exposure or service disruption. On servers that normalize or lowercase header names, the specific forgery path described may not trigger.

This is a low-severity, low-priority finding across essentially every signal, and the signals are consistent with one another rather than conflicting. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) describes a network-reachable, unauthenticated flaw with no confidentiality or availability impact and only a Low integrity impact, reflecting that the attacker can forge an order-paid state but cannot read data, execute code, or disrupt service. EPSS is very low (0.11%, 1st percentile), there is no CISA KEV listing (not actively exploited), and the vuln.today decision label is 'monitor' - all three agree this is not an urgent, widely-exploited issue. The one nuance worth flagging: exploitation is gated on a non-default environmental condition (the web server must preserve the case of request headers), which is exactly what justifies AC:H and keeps real-world risk below what 'unauthenticated network' alone might imply. The practical business risk - marking arbitrary WooCommerce orders as paid, i.e. payment-bypass fraud on a crypto storefront - is more meaningful to an affected merchant than the 3.7 score suggests, but the limited deployment footprint and the header-case precondition keep aggregate risk low. Net: a genuine authentication-bypass bug worth patching on a normal cycle, not an emergency.

On a WooCommerce store running the TiendaCrypto plugin behind a web server that preserves request-header case, an unauthenticated attacker places an order and then sends a forged payment webhook notification whose signature passes validation because the plugin checks it against a key that is always empty. The store marks the attacker's order as paid without any real payment, enabling fulfillment of goods/services for free. A public PoC reference exists (WPScan); it is not verified as working exploit code, and success depends on the server's header-case handling.