elegro Crypto Payment EUVD-2026-92966

The target installation must have the elegro shared secret left at its default empty (never-configured) value; the plugin then trusts incoming payment-notification requests without validating any secret, so an attacker can forge confirmations. LIMITING FACTOR: once an administrator configures a non-empty shared secret, notification requests are validated and the attack no longer works, so hardened/fully-configured sites are not affected. No authentication, user interaction, or special network position is required against a vulnerable default-config install of elegro Crypto Payment through v1.0.1.

Moderate, conditional risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 6.5) describes a remote, unauthenticated, low-complexity attack with low integrity and low confidentiality impact and no scope change, which is consistent with the CWE-863 (improper authorization) description. Exploitation is publicly demonstrated - WPScan published a PoC - but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active, widespread exploitation; POC availability and active exploitation are distinct signals and only the former is present here. The decisive risk modifier is the precondition: only installations where the shared secret is still at its default empty (unconfigured) value are exploitable, which bounds the real-world blast radius to misconfigured/freshly-installed sites. I would treat this as a genuine but second-tier priority rather than an emergency: the integrity impact (forging payment confirmations to flip order status to paid) has direct financial-fraud consequences for affected stores, yet the niche product footprint and the configuration dependency keep aggregate risk below that of a critical, default-exploitable flaw. Note: the source vector asserts C:L, but the description only supports order-status manipulation (an integrity effect), not information disclosure - my independent assessment drops confidentiality to N; verify against the WPScan advisory. EPSS and KEV data are absent, so exploitation-likelihood scoring could not be cross-referenced.

An attacker identifies a WooCommerce store running elegro Crypto Payment (≤1.0.1) whose shared secret has never been configured and remains empty. They place an order, then send a crafted unauthenticated HTTP request to the plugin's payment-notification callback forging a successful-payment confirmation, which flips their order to a paid/completed status and lets them obtain goods or services without paying. A public proof-of-concept for this flaw has been published by WPScan.