Casso Flow CVE-2026-103382

Exploitable on a default installation of the Casso Flow plugin (versions before 4.2.0), where the token used to verify incoming bank-transfer payment notifications is empty, allowing an unauthenticated remote attacker to forge a notification. Concrete prerequisites: the store must run WooCommerce with the Casso Flow plugin active, and there must be a pending order (any payment method) for the attacker to flip to paid. Limiting factors: impact is confined to order payment status (integrity only - no data disclosure or outage); the bypass depends on the default empty-token configuration, so merchants who have set a non-empty verification token may not be exploitable; the attacker must know or discover the notification endpoint and have an order in the pending state.

This is a moderate, integrity-only authentication-bypass issue rather than a top-tier emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N, score 5.3) describes a remotely reachable, unauthenticated, low-complexity flaw whose only impact is a limited integrity violation - forging a bank-transfer payment notification to flip a pending WooCommerce order to 'paid'. There is no confidentiality or availability impact. EPSS is low at 0.15% (4th percentile) and the flaw is not in CISA KEV, so there is no public-scale or confirmed active exploitation signal; exploitation status is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', which aligns with a 'patch on a normal cadence' posture rather than act_now/emergency. The practical risk is business/financial fraud for the specific merchants running this plugin (attacker obtains goods/services without paying), which can be material to those merchants even though the technical severity is medium. Note one dependency to verify: the bypass is described as effective 'on a default installation' because the verification token is empty by default - merchants who have configured a non-empty token may not be exploitable, which the CVSS PR:N does not capture.

An attacker places an order in a target WooCommerce store, selecting (or simply leaving) it in a pending state, then sends a forged bank-transfer payment-notification request to the Casso Flow endpoint. Because the verification token is empty on a default installation, the forged notification passes authentication and the order is marked paid, letting the attacker receive goods or services without paying. No public exploit code is identified, but the technique is low-complexity and requires no authentication or user interaction.