Mintpay for WooCommerce CVE-2026-103381

Exploitation requires only that the Mintpay for WooCommerce plugin (version ≤ 2.2.3) be installed and active on a reachable WooCommerce store; per the description the plugin does not verify the authenticity of the payment callback it processes, so a remote, unauthenticated attacker can invoke that callback handler directly. Consistent with AV:N/AC:L/PR:N/UI:N, there is no authentication, user interaction, or special non-default configuration requirement stated in the sources. The practical limiting factors are narrow: the target store must run this specific regional BNPL plugin, and an attacker targeting a particular transaction may need to reference or enumerate valid order identifiers, though the advisory describes action against arbitrary orders.

This is a moderate-severity access-control flaw (CWE-284) in a specific WooCommerce payment-gateway plugin, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated issue requiring no user interaction, which matches the description of a forgeable, unauthenticated payment callback. Impact is bounded: C:L/I:L/A:N reflects limited disclosure of order/customer data and limited integrity impact (marking orders paid, cancelling orders) without system-level compromise, so the 6.5 (Medium) score is credible and not inflated. There is no CISA KEV listing and no EPSS score in the input, so widespread or automated exploitation is not demonstrated; the only exploitation signal is a single WPScan PoC reference that is not verified as working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-emergency priority. The main real-world driver of risk is financial: an attacker able to mark orders 'paid' without payment could defraud a merchant, which may matter more to affected store owners than the Medium CVSS implies - but this is scoped to stores actually running this plugin.

An unauthenticated attacker sends a forged Mintpay payment-callback request to a WooCommerce store running the vulnerable plugin; because the plugin never verifies the callback's authenticity, the attacker can mark an order as paid without any real payment, cancel other customers' orders, or read back order details including customer contact information. A public PoC reference (WPScan) exists but is not verified as working exploit code, so exploitation is plausible but not demonstrated at scale.