PeachPay CVE-2026-103376

Exploitation requires only that the PeachPay - Payments & Express Checkout for WooCommerce plugin (version 1.117.9 up to but not including 1.120.70) be installed and active on a reachable WooCommerce store, with paid orders whose secret keys can be requested. Per CVSS PR:N/UI:N/AV:N, no authentication, no user interaction, and no special non-default configuration are stated as required - exploitation works against standard installations of the affected plugin over the network. The only meaningful limits are that the attacker must reach the store's HTTP endpoint and reference valid paid orders, and that impact is confined to reading order-level customer PII, not account takeover or site compromise. Upgrading to 1.120.70 or later removes the exposure.

All signals point to a genuine but moderate-severity information-disclosure flaw rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity access with no user interaction, which maximizes exploitability, but impact is deliberately scoped as C:L/I:N/A:N - only confidentiality of order data, no integrity or availability effect - hence the 5.3 Medium base score. No EPSS probability, KEV listing, POC, or SSVC decision data were provided, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (the network vector in CVSS matches the 'unauthenticated request' in the description), so there is no CVSS-versus-description conflict to flag. The practical risk is bulk harvesting of customer PII (name, email, postal address, order contents) from paid orders, carrying privacy/GDPR and phishing-fraud consequences even though it is not a system-compromise bug. Priority should be treated as moderate: patch promptly because the attack is trivial and PII is exposed, but it does not rise to critical given no code execution, no active-exploitation signal, and confidentiality-only impact.

An unauthenticated attacker enumerates or references paid WooCommerce order identifiers and sends crafted HTTP requests to the vulnerable PeachPay endpoint, which returns each order's secret key without any capability or ownership check. Using the leaked keys, the attacker retrieves the associated customer's name, email, postal address, and order contents at scale. No public exploit code is identified at time of analysis, but the low attack complexity makes scripted mass-harvesting straightforward.