Description
The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.
Published: 2026-10-27
Score: n/a
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 10:45:00 +0100

Type Values Removed Values Added
Weaknesses CWE-20
CWE-639
CWE-665

Tue, 27 Oct 2026 07:15:00 +0100

Type Values Removed Values Added
Description The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.
Title Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-27T06:00:20.103Z

Reserved: 2026-09-30T11:42:59.430Z

Link: CVE-2026-103312

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T06:17:23.120

Modified: 2026-10-27T06:17:23.120

Link: CVE-2026-103312

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:30:19Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-639

    Authorization Bypass Through User-Controlled Key

  • CWE-665

    Improper Initialization