EUVD-2026-95709
GHSA-h768-c99r-wgcc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliveryPlace WooCommerce order
-
ExploitForge webhook signed with empty key
-
ExecutionSubmit crafted payment notification
-
ImpactOrder marked paid without payment
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | The site must run the Super Payments WordPress plugin (version before 1.43.1) integrated with WooCommerce and expose its payment webhook endpoint. The critical enabling condition is default configuration itself: the signature-validation signing key is EMPTY by default, so a freshly installed, un-customized plugin is vulnerable with no special setup - an unauthenticated remote attacker can compute a matching signature over forged webhook data. Limiting factors: the attacker must target a site that uses this specific plugin, and exploitation is scoped to manipulating order payment status (no data exfiltration or service disruption); operators who manually set a non-empty signing key would not be exploitable in the same way. |
| Impact | This is a medium-severity (CVSS 5.3) integrity flaw whose business impact exceeds its raw score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - a favorable profile for attackers - but scope is Unchanged and impact is limited to Integrity (I:L, with C:N/A:N), which is why the score stays moderate rather than high. However, the CVSS Integrity:Low rating understates the real-world consequence: forging webhooks to mark WooCommerce orders 'paid' enables direct financial fraud (goods/services obtained without payment), so defenders should weight this above a typical 5.3. Publicly available exploit code (POC) exists per WPScan, raising practical risk, but there is no EPSS score and no CISA KEV listing provided, so there is no evidence of active mass exploitation at this time - the signal is 'POC available, exploitation feasible against default configs' rather than 'confirmed in-the-wild.' Note a tagging conflict: the 'Information Disclosure' tag contradicts the CVSS vector (C:N), as this is a payment-integrity/business-logic flaw, not a confidentiality issue - treat the Information Disclosure label as inaccurate. |
| Exploit ScenarioDerived | An attacker identifies an e-commerce site running the Super Payments plugin (before 1.43.1) with WooCommerce and places an order. Because the webhook signing key is empty by default, they forge a payment-confirmation webhook with a self-computed 'valid' signature and send it to the site's webhook endpoint, causing the order to be marked paid without any funds changing hands. Public exploit code referenced by WPScan lowers the skill barrier for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Forging payment webhook signatures in the Super Payments WordPress plugin (before 1.43.1) allows unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without payment, because the plugin ships with an empty signature-validation signing key by default. The medium-severity (CVSS 5.3) integrity flaw has business impact that exceeds its raw score; publicly available exploit code exists, though no confirmed active exploitation has been observed (not listed in CISA KEV). Affected sites are those using the vulnerable plugin with WooCommerce and exposed webhook endpoints, and the default configuration itself is the enabling condition.
RemediationAI
Vendor-released patch: upgrade to Super Payments 1.43.1 or later, which initializes a non-empty signing key and properly validates webhook signatures. Site administrators should apply this update immediately. If immediate patching is not possible, configure the plugin to use a non-empty, strong signing key in its settings (the default empty key is the root cause) and verify that the key matches the one configured in the Super Payments merchant dashboard; this workaround requires manual configuration and may break webhook processing if the key is mismatched. Additionally, restrict access to the webhook endpoint by IP allowlisting (e.g., only the payment provider's IP ranges) if feasible, though this can be bypassed by spoofing and may not be supported by the plugin. Monitoring WooCommerce orders for unexpected status changes to 'paid' can help detect exploitation. See the WPScan advisory at https://wpscan.com/vulnerability/aefba87d-fa4c-4b7c-9436-6e79e966e8a5/ for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the webhook signature verification mechanism of the Super Payments WordPress plugin, which integrates with WooCommerce to process payments. Webhooks are HTTP callbacks from the payment provider to the site, and their authenticity is typically ensured by computing a cryptographic signature (e.g., HMAC) over the request payload using a shared secret key. In affected versions, the plugin initializes this signing key to an empty string, so the verification routine accepts any signature computed with an empty key - effectively making forgery trivial. The CPE string cpe:2.3:a:unknown:super_payments:*:*:*:*:*:*:*:* identifies the plugin as the affected product, and while no CWE is assigned, the root cause is improper verification of a cryptographic signature (CWE-347) or missing authentication for a critical function. The default configuration itself is the enabling condition, meaning no special setup is required beyond installing and integrating the plugin with WooCommerce.
Know when Super Payments gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote webhook endpoint with an empty default signing key gives AV:N/AC:L/PR:N/UI:N; impact is limited order-status tampering so I:L with C:N/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB