Payconiq WordPress Plugin CVE-2026-103372

No special configuration is required: the plugin returns an order's confirmation link/key without verifying the requester is authorized, so any site running Payconiq ≤1.0.4 with paid orders is exposed to unauthenticated remote retrieval of order keys. The key limiting factor is scope of data returned - full customer personal details are only exposed for 'recent guest orders,' while older or account-based orders leak only the order key. Exploitation requires no authentication (PR:N) and no user interaction (UI:N), and works against default configurations; the only practical constraint is that meaningful PII harvesting depends on the presence of recent guest-checkout orders.

Signals are mostly aligned toward a genuine-but-moderate issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity access with no user interaction, but impact is scoped narrowly to confidentiality only (C:L/I:N/A:N), yielding a 5.3 MEDIUM - consistent with an information-disclosure (CWE-200) flaw. EPSS is low at 0.16% (6th percentile), indicating no observed mass-exploitation pressure, and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed active exploitation. The vuln.today decision label is 'this_month,' which positions it as a scheduled remediation priority rather than act_now/emergency. The data is internally consistent: a low-privilege network flaw with limited impact and low exploitation probability. The main nuance is that the leak has two tiers - any paid order's confirmation key is exposed to anyone, while fuller customer personal details are only exposed for 'recent guest orders,' which caps the practical data-harvesting window.

An unauthenticated attacker requests order confirmation links from a site running the Payconiq plugin and receives the order key for any paid order without authorization. For recent guest orders, this additionally returns the customer's personal details, enabling privacy harvesting. No public exploit code is identified, but the flaw is trivially reachable over the network against default configurations.