EUVD-2026-115720
GHSA-xpq3-q6vx-4qg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate CryptoCloud gateway callback endpoint
-
ExploitCraft unsigned forged payment notification
-
ExecutionIntegrity check bypassed via empty webhook secret
-
ImpactTarget order marked paid or failed without payment
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the plugin's webhook secret to remain at its empty default value; in that state the gateway callback skips the payment-notification integrity/authenticity check, letting an unauthenticated remote attacker POST a forged notification to mark arbitrary orders as paid or failed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is needed. The limiting factor is configuration: installs where an administrator has set a non-empty webhook secret restore the integrity check and are not affected, so the realistic exposure is default or unconfigured deployments of CryptoCloud 3.0.0-3.0.1. |
| Impact | This is a moderate-severity, integrity-only flaw (CVSS 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) in the CryptoCloud WordPress payment plugin. The signals point to a real but bounded concern rather than a top-tier emergency: the attack vector is network-based and unauthenticated (PR:N), which favors easy exploitation, but the impact is limited to integrity (I:L) with no confidentiality or availability effect. Exploitation is further gated by a configuration condition (empty default webhook secret), so it does not affect every install unconditionally. No CISA KEV listing and no EPSS score are present in the supplied data, so widespread automated exploitation cannot be confirmed or ruled out from these sources; the vuln.today decision label is 'this_month' (not act_now or emergency), consistent with prioritized-but-not-urgent remediation. A public PoC reference exists via WPScan; it is not verified as working exploit code, so PoC availability must not be read as active exploitation. The net real-world risk is meaningful for merchants using the plugin - fraudulent 'paid' order status without payment is a direct financial-fraud vector - but it is a targeted business-logic abuse, not a system-compromise bug, and EPSS/KEV data being absent means spread cannot be quantified from this input. |
| Exploit ScenarioDerived | An attacker identifies a store running the CryptoCloud plugin whose webhook secret is unset (the default) and sends a forged payment-notification request to the gateway callback endpoint, which skips the integrity check and accepts it. With no valid signature required, the attacker marks their own (or arbitrary) order as paid to obtain goods or services without paying, or marks a victim's order as failed to disrupt fulfillment. A public PoC reference exists via WPScan but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Unauthenticated attackers can forge CryptoCloud payment notifications to mark arbitrary WooCommerce/WordPress orders as paid or failed without any cryptocurrency payment being made, affecting plugin versions 3.0.0 through 3.0.1. The gateway callback skips its payment-notification authenticity check whenever the webhook secret is still at its empty default, so the flaw is exploitable only on default or unconfigured installs; sites where an administrator has set a non-empty secret retain the integrity check and are unaffected. Severity is moderate and integrity-only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and a public PoC reference exists at the WPScan advisory though it is not verified as working exploit code; there is no CISA KEV entry and no public exploit identified at time of analysis.
RemediationAI
No patched version is specified in the available data, so confirm the current fixed release with the vendor and the WPScan advisory (https://wpscan.com/vulnerability/fd5563ed-85c6-4b17-acf6-bdc2cd77dd4b/) before upgrading, and treat upgrading as the primary fix once a corrected release is published. The decisive compensating control is to set a non-empty, high-entropy webhook secret in the CryptoCloud gateway settings on every affected site - this restores the payment-notification integrity check and removes the bypass; the trade-off is that the same secret must be configured identically in the CryptoCloud merchant dashboard, or legitimate callbacks will fail verification and orders will not be marked paid automatically. Where the secret cannot be set, or until it is, disable the CryptoCloud gateway for new orders (or deactivate the plugin) so that forged callbacks have no order state to manipulate; the trade-off is loss of automated crypto payment processing. As a secondary check, audit recent order status changes on 3.0.0-3.0.1 installs with an empty secret for orders marked paid without a corresponding on-chain transaction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the plugin's payment-gateway callback endpoint, which receives asynchronous payment notifications from the CryptoCloud service and updates local order state accordingly. The intended design is for the callback handler to validate the authenticity/integrity of each notification using a shared webhook secret; per the advisory, that check is skipped when the secret is left at its empty default, so the handler accepts attacker-supplied notification bodies at face value. Because the endpoint is reachable over the network and the CVSS vector carries PR:N and UI:N, no credentials or victim interaction are required - a single forged HTTP POST is enough to flip an order's payment status. The root-cause class is a missing/improper authentication check on a webhook (CWE is not assigned in the supplied data; the trigger is a configuration-dependent bypass of the callback integrity verification, not a memory-safety or injection flaw). The CPE is recorded as cpe:2.3:a:unknown:cryptocloud with the vendor field unresolved, so identification of affected installs should be done by plugin slug and version rather than by CPE vendor matching.
Know when Cryptocloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated forged webhook needs no interaction (AV:N/AC:L/PR:N/UI:N); impact is limited modification of order payment status (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
DescriptionCVE.org
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB