AmazonPay Plugin CVE-2026-103671

Exploitation requires an EC-CUBE 4-series store with the AmazonPay plugin installed and active (AmazonPay v2 plugin for the 4.0/4.1, 4.2/4.3, and 4.2/4.3 bundle editions, or the AmazonPay v1 plugin for the 4.0 series), AND a victim shopper actively engaged in the ordering/checkout process. The attacker supplies an externally controlled, assumed-immutable web parameter that the checkout flow trusts, causing redirection to an arbitrary external site where account information can be captured. Limiting factors: the attack is not self-contained - it needs victim interaction during an in-progress order (UI:R), so a user must be socially engineered into following the tampered flow; there is no direct server-side confidentiality or availability impact and the attacker gains no privileges on the shop itself. Stores without the AmazonPay plugin are unaffected.

This is a moderate-severity (CVSS 4.7) open-redirect-style flaw (CWE-472, external control of an assumed-immutable web parameter) in the AmazonPay plugin for the EC-CUBE 4 e-commerce platform. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) indicates a network-reachable, low-complexity issue requiring no attacker authentication (PR:N) but mandatory victim interaction (UI:R) during the checkout flow, with a scope change (S:C) reflecting that harvested account information crosses from the shop to an attacker-controlled destination. The direct technical impact is limited (integrity-low only; no confidentiality or availability impact on the host itself), so this is NOT a system-compromise bug - it is a user-targeted phishing/redirection vector. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the dependence on user interaction and the socially-engineered nature of the attack make opportunistic mass-exploitation unlikely. Net assessment: a real but contained risk that merits patching on affected EC-CUBE shops, not an emergency - a medium-CVSS issue whose real-world danger hinges on successful social engineering of shoppers mid-order rather than on an unauthenticated remote takeover.

An attacker crafts a malicious link or tampered order parameter for an EC-CUBE 4 storefront running the AmazonPay plugin and lures a shopper to begin or continue checkout. Because the ordering flow trusts an attacker-controllable parameter, the victim is redirected mid-order to an attacker-controlled site that mimics the payment/login step and harvests their account information. No public exploit code is identified at time of analysis, and success depends on the victim following the crafted ordering flow (UI:R).