Pay With MetaMask CVE-2026-107420

Exploitation requires only that the target WooCommerce site has the 'Pay With MetaMask For WooCommerce - Cryptocurrency Payment Gateway' plugin installed at version 1.7.2 or earlier and reachable over the network; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is required beyond the plugin being active. Limiting factors: the attack surface exists ONLY on sites running this specific plugin (a niche crypto-payment gateway, so overall exposure is small), impact is confined to integrity (I:L) with no confidentiality or availability effect, and the input does not name the exact bypassed feature/endpoint - the precise trigger should be confirmed against the Patchstack advisory before assuming payment-status forgery.

Signals are mixed and skew toward moderate, not high priority. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N, indicating remote, low-complexity, unauthenticated exploitation - attractive characteristics - but impact is constrained to C:N/I:L/A:N, i.e. a limited integrity effect only, no confidentiality or availability loss and no scope change (S:U). CWE-345 (insufficient verification of data authenticity) combined with the 'bypass' label most plausibly points to a payment/authenticity verification weakness in the gateway rather than full account or site takeover, which is consistent with the low integrity-only impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization. The exposure is therefore 'easy to reach but low-consequence per event.' Key missing data to note explicitly: no EPSS probability is supplied, so likelihood-of-exploitation cannot be quantified; the Patchstack reference is the sole source and the description does not specify the exact bypassed mechanism, so the precise security impact (e.g. whether order payment status can be forged) should be verified with the vendor/Patchstack advisory.

A remote, unauthenticated attacker sends a crafted request to a WooCommerce store running the vulnerable Pay With MetaMask plugin (<= 1.7.2), abusing the plugin's insufficient verification of data authenticity (CWE-345) to bypass an intended check. Given AV:N/AC:L/PR:N and integrity-limited impact (I:L), the realistic outcome is manipulation of a plugin-controlled state - most plausibly forging or bypassing payment/transaction verification - rather than data theft or service disruption. No public exploit code was identified at time of analysis.