EUVD-2026-94827
GHSA-wvf8-rf78-rqr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify store with no webhook secret set
-
ExploitCraft forged payment-success notification
-
ExecutionPOST to plugin webhook endpoint unauthenticated
-
ImpactOrder marked paid without payment received
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Exploitable only when NO webhook secret has been configured in the Airwallex Online Payments Gateway plugin (versions before 1.36.0); in that state the plugin skips verifying that a payment notification genuinely originated from Airwallex. The attacker needs network access to the plugin's publicly reachable webhook/notification endpoint and no authentication or user interaction. The primary limiting factor is the configuration gate: stores that have set a webhook secret are not affected, so risk is confined to unconfigured or partially-configured installations; impact is limited to falsifying order/payment state (integrity), not data theft or downtime. |
| Impact | This is a moderate, business-logic integrity flaw rather than a system-compromise vulnerability. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) correctly reflects a remote, unauthenticated issue with LOW integrity impact only and no confidentiality or availability impact - consistent with CWE-345 (insufficient verification of data authenticity). Publicly available exploit code exists (reported by WPScan), which raises practical exploitability, but the issue is NOT in CISA KEV and no active exploitation is indicated. No EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified here. SSVC inputs (exploitation status, automatable, technical impact) were not supplied. The key caveat is the gating condition: exploitation only works when NO webhook secret has been configured, so real-world risk is concentrated on incompletely-configured stores. Note a tag discrepancy - the input tags this as 'Information Disclosure', but CVSS shows C:N and I:L, meaning the real impact is integrity (forged payment state), not information disclosure; treat the 'Information Disclosure' label as incorrect. |
| Exploit ScenarioDerived | An attacker targets a WooCommerce/WordPress store running the Airwallex plugin (before 1.36.0) that has not configured a webhook secret. Because the plugin does not verify the authenticity of incoming payment notifications in that state, the attacker sends a forged 'payment succeeded' notification to the plugin's webhook endpoint and the store marks the order as paid. Public exploit/advisory detail is available via WPScan, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 accepts forged payment notifications and marks orders as paid when no webhook secret has been configured, allowing unauthenticated remote attackers to obtain goods or services without completing payment. The flaw is a business-logic integrity issue rather than a system-compromise bug: CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to falsified order/payment state. It is exploitable only on stores that have left the webhook secret empty, and publicly available exploit code exists (WPScan); there is no evidence of confirmed active exploitation in the wild.
RemediationAI
Vendor-released patch: upgrade the Airwallex Online Payments Gateway plugin to version 1.36.0 or later, which restores verification of incoming payment notifications. Because the flaw only manifests when no webhook secret is set, the strongest compensating control available before patching is to configure a webhook secret in the plugin's Airwallex settings and enable signature verification - this closes the attack path for that store and carries no functional downside, though it must be applied to every affected site in the estate. If patching or configuration is not immediately possible, reduce exposure by restricting the plugin's notification endpoint at the edge (WAF rule or reverse-proxy allowlist limited to Airwallex's published webhook source IP ranges); the trade-off is that Airwallex IP ranges can change and over-tight rules will silently drop legitimate callbacks, so monitor for missed payment notifications. Additional detection-oriented measures: alert on order status transitions to paid that have no corresponding transaction in the Airwallex dashboard, and periodically reconcile WooCommerce orders against Airwallex settlement reports to catch forged payments after the fact. Removing or disabling the payment gateway eliminates the risk entirely but also disables that payment method for customers. See the WPScan advisory at https://wpscan.com/vulnerability/17179c6d-32e0-4a22-88b4-9768a5f36365/ for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WooCommerce/WordPress payment gateway integration for the Airwallex payment provider, identified by CPE cpe:2.3:a:unknown:airwallex_online_payments_gateway:*:*:*:*:*:*:*:* (vendor string unresolved in the CPE dictionary). Like most hosted-checkout integrations, the plugin exposes a publicly reachable webhook endpoint that Airwallex calls to report payment lifecycle events (for example, payment succeeded). The correct design authenticates those callbacks by computing an HMAC/signature over the request body with a shared webhook secret and comparing it to the value supplied in the request; the plugin class maps to CWE-345 (Insufficient Verification of Data Authenticity) because, when no webhook secret is configured, that authenticity check is skipped entirely instead of failing closed. Any unauthenticated party who can reach the endpoint can therefore POST a syntactically valid notification and drive the plugin's order-status logic, transitioning a WooCommerce order to 'paid'. The CVSS vector (PR:N, UI:N, C:N/I:L/A:N) confirms the attacker needs no credentials or user interaction and that the consequence is a low-integrity state change with no confidentiality or availability loss. Treat the 'Information Disclosure' tag in the aggregated feed as a mislabel; the assessed impact is payment/order integrity, not data exposure.
Know when Airwallex Online Payments Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated forging of payment notifications (AV:N/PR:N/UI:N); only integrity of order state is affected (I:L), with no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB