Cardinity Payment Gateway EUVD-2026-101860

Exploitable against DEFAULT installations: the plugin ships with an empty signing secret and does not properly verify notification authenticity, so an unauthenticated remote attacker can forge an 'approved payment' (or 'failed') notification to the plugin's payment-callback handler with no user interaction. The specific prerequisite is simply that the store runs Cardinity Payment Gateway for WooCommerce before 3.4.2 with the default (empty) notification secret. The main limiting factors are footprint-based rather than technical: the target must use this specific Cardinity plugin, and a merchant who has manually configured a non-empty, properly validated secret would reduce exposure; practical impact is confined to order-status manipulation (payment fraud), not code execution or data theft.

Signals are consistent and point to a real-but-bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, and a public exploit exists (WPScan-reported), so attack feasibility is high. However, impact is deliberately scored low: C:N/A:N with only I:L, reflecting that an attacker can forge the payment-notification callback to flip order status (mark unpaid orders as 'paid' or push legitimate orders to 'failed') but cannot read data, execute code, or take down the service. No EPSS score and no CISA KEV entry were provided, so exploitation is 'publicly available exploit code exists' - NOT confirmed active exploitation; do not treat the public POC as in-the-wild use. The business risk (payment fraud / obtaining goods without payment) is more serious than the 5.3 base score suggests for affected merchants, but the narrow affected population and integrity-only impact keep this a medium-priority patch rather than an emergency for most environments. One data note: the input Tags label this 'Information Disclosure,' which contradicts the C:N vector and the description - this is an authentication/integrity flaw, not disclosure.

An attacker identifies a store running the vulnerable Cardinity gateway and sends a crafted payment-notification request to the plugin's callback endpoint. Because the signing secret is empty by default, the attacker can forge a validly 'signed' approved-payment message and have the store mark their order as paid without ever paying - enabling fraudulent checkout - or conversely force victims' orders to 'failed.' A public exploit for this flaw has been published by WPScan.