Payex Payment Gateway EUVD-2026-110607

Exploitation requires only that the target store runs the Payex Payment Gateway for WooCommerce plugin (version ≤1.2.10) with its validation secret left at the empty default - which is the out-of-the-box configuration, so most installations are affected without any special setup. The attacker needs network access to the plugin's payment-notification callback endpoint; no authentication, credentials, or user interaction are required (AV:N/AC:L/PR:N/UI:N). The main limiting factor is that an administrator who has manually configured a non-empty validation secret would not be vulnerable, and impact is confined to order/payment state (marking orders paid) rather than site compromise or data disclosure.

This is a moderate-severity integrity flaw whose signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) correctly reflects the description: because the validation secret is empty by default, an unauthenticated remote attacker can forge payment notifications with no special access and no user interaction. However, the real-world risk is bounded by impact scope - CVSS is only 5.3 because confidentiality and availability are untouched (C:N/A:N) and only integrity is partially affected (I:L): the attacker can mark orders as paid but cannot read data, take over the site, or run code. EPSS is low at 0.13% (3rd percentile) and the vulnerability is NOT on CISA KEV, so there is no evidence of active or widespread exploitation; no public exploit code was identified at time of analysis. The vuln.today decision label is 'this_month' (a routine-priority bucket, not act_now/emergency), aligning with the low-EPSS, non-KEV picture. Net: this is a real and easily-triggerable authentication-bypass bug that directly enables payment fraud against any store running the plugin, but it is a targeted fraud/abuse risk rather than a mass-exploitation or system-compromise emergency. Patch on a normal cadence, prioritized for sites actively processing live payments.

An attacker places (or references) an order in a victim store running the plugin, then sends a crafted HTTP payment-notification callback to the plugin's endpoint. Because the validation secret is empty by default, the plugin accepts the forged notification as authentic and marks the order as paid, letting the attacker obtain goods or services without actually paying. No authentication, user interaction, or exploit tooling is required (no public PoC was identified).