EUVD-2026-110631
GHSA-563r-v2v8-6c3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate store running PayDunya plugin
-
DeliveryCraft forged payment notification
-
ExploitCompute signature from empty secret
-
ExecutionPOST to plugin notification endpoint
-
ImpactOrder marked paid and completed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Requires a WordPress site running WooCommerce with the PayDunya WooCommerce Payment Gateway plugin (through 1.1.6) installed and active, and reachable payment-notification/callback handling. Two concrete triggers: (1) the plugin does not verify the authenticity of incoming payment notifications at all, and (2) until the gateway is configured, notifications are authenticated with a value derived from an empty secret that any attacker can compute. No authentication, user interaction, or non-default toggle is needed (PR:N/UI:N). Limiting factors: impact is confined to marking WooCommerce orders as paid/completed (financial/fraud, no data exposure or outage), and the issue is most acute in the unconfigured-gateway state; the small deployment footprint of this regional gateway further limits real-world exposure. |
| Impact | Signals are consistent and point to a real but bounded financial-fraud risk rather than a widespread emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated flaw with no confidentiality or availability impact and only Low integrity impact, yielding 5.3 (Medium); this matches the described defect - the plugin does not verify the authenticity of incoming payment notifications, and before the gateway is configured it validates them with a value derived from an empty secret that anyone can compute. EPSS is very low (0.11%, percentile 1%) and the vuln is NOT on CISA KEV, so there is no confirmed active exploitation; a public PoC reference (WPScan) exists but is not verified as working exploit code. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with the picture of an easy-to-exploit but narrowly-scoped, lower-prevalence issue. The main tension is that the trivial exploitability (no auth, no interaction, computable signature) contrasts with the modest 5.3 score and low EPSS - the score is held down because the impact is limited to order-status manipulation (I:L only), not data theft or service disruption, and because the affected product has a small footprint. No SSVC/CWE data was supplied to further triage; CWE is N/A in the input. |
| Exploit ScenarioDerived | An attacker identifies a WooCommerce store running the PayDunya payment gateway plugin and, because the plugin does not authenticate payment notifications (and uses a computable empty-secret value before configuration), sends a forged notification to the store's callback endpoint. The forged notification causes an arbitrary order to be marked paid and completed, letting the attacker obtain goods or services without paying. A public PoC reference exists (WPScan) but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 lets unauthenticated remote attackers mark arbitrary WooCommerce orders as paid and completed, because incoming payment notifications are not checked for authenticity and, while the gateway remains unconfigured, are validated with a value derived from an empty secret that anyone can compute. Sites running WordPress with WooCommerce and this plugin active are exposed with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3), and the impact is confined to order-state fraud rather than data exposure or outage. There is no CISA KEV entry and no confirmed exploitation; a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.11% (1st percentile).
RemediationAI
No vendor-released patch or fixed version is identified in the available data: EUVD lists 1.1.6 as the affected (and apparently latest listed) version, and the WPScan advisory at https://wpscan.com/vulnerability/d2d7c885-9525-41e0-9666-04a4a8cd183f/ should be checked for an updated fixed release before upgrading. Until a fix is published, the decisive control is to deactivate and remove the PayDunya WooCommerce Payment Gateway plugin, accepting the loss of that payment option; because one of the two triggers is the unconfigured-gateway state, completing gateway configuration with a non-empty secret removes the empty-secret authentication path, but it does not address the separate finding that the plugin does not verify the authenticity of incoming payment notifications at all. Sites that must keep the plugin should reconcile WooCommerce order status against PayDunya settlement records rather than trusting plugin-driven paid/completed transitions, which adds manual reconciliation overhead; the reported risk is bounded financial fraud on order state, consistent with a this-month rather than emergency remediation priority given the absence of KEV listing and the 0.11% EPSS score.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress payment-gateway plugin that integrates the regional PayDunya service with WooCommerce, receiving server-to-server payment notifications (callbacks) and using them to transition order status. The flaw sits in that callback handling path: the plugin does not verify the authenticity of incoming payment notifications, and in the pre-configuration state it authenticates them with a value derived from an empty secret, which any attacker can compute. The provided record carries no CWE mapping, so the root-cause class is best described from the evidence as missing authentication of a critical function combined with reliance on a predictable, empty-secret-derived token for integrity checking. Because the notification endpoint is web-reachable and needs no credentials, an attacker who can address it can assert payment for an arbitrary order identifier; the trigger mechanics beyond this are not described in the available sources. The plugin is additionally identified only by a placeholder CPE (cpe:2.3:a:unknown:paydunya_woocommerce_payment_gateway), and EUVD lists 1.1.6 and earlier as affected.
Know when Paydunya Woocommerce Payment Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated forgery of payment notifications with no interaction (AV:N/AC:L/PR:N/UI:N); only order state is tampered, giving I:L with no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
DescriptionCVE.org
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB