PayDunya Payment Gateway CVE-2026-103359

Requires a WordPress site running WooCommerce with the PayDunya WooCommerce Payment Gateway plugin (through 1.1.6) installed and active, and reachable payment-notification/callback handling. Two concrete triggers: (1) the plugin does not verify the authenticity of incoming payment notifications at all, and (2) until the gateway is configured, notifications are authenticated with a value derived from an empty secret that any attacker can compute. No authentication, user interaction, or non-default toggle is needed (PR:N/UI:N). Limiting factors: impact is confined to marking WooCommerce orders as paid/completed (financial/fraud, no data exposure or outage), and the issue is most acute in the unconfigured-gateway state; the small deployment footprint of this regional gateway further limits real-world exposure.

Signals are consistent and point to a real but bounded financial-fraud risk rather than a widespread emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated flaw with no confidentiality or availability impact and only Low integrity impact, yielding 5.3 (Medium); this matches the described defect - the plugin does not verify the authenticity of incoming payment notifications, and before the gateway is configured it validates them with a value derived from an empty secret that anyone can compute. EPSS is very low (0.11%, percentile 1%) and the vuln is NOT on CISA KEV, so there is no confirmed active exploitation; a public PoC reference (WPScan) exists but is not verified as working exploit code. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with the picture of an easy-to-exploit but narrowly-scoped, lower-prevalence issue. The main tension is that the trivial exploitability (no auth, no interaction, computable signature) contrasts with the modest 5.3 score and low EPSS - the score is held down because the impact is limited to order-status manipulation (I:L only), not data theft or service disruption, and because the affected product has a small footprint. No SSVC/CWE data was supplied to further triage; CWE is N/A in the input.

An attacker identifies a WooCommerce store running the PayDunya payment gateway plugin and, because the plugin does not authenticate payment notifications (and uses a computable empty-secret value before configuration), sends a forged notification to the store's callback endpoint. The forged notification causes an arbitrary order to be marked paid and completed, letting the attacker obtain goods or services without paying. A public PoC reference exists (WPScan) but is not verified as working exploit code.