{"id":"CVE-2026-103312","aliases":[],"title":"Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"Payment Integration Wompi","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.0.1","versionType":"semver"}],"defaultStatus":"unknown","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-103312"}],"remediation":[],"description":"The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.","severity":"unknown","score":null,"published":"2026-10-27T06:00:20.103Z","modified":"2026-10-28T17:58:09.938Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/617a62de-f7d6-461e-bbf2-db6092a3346f/"],"sources":[{"name":"CVE","id":"CVE-2026-103312","modified":"2026-10-28T17:58:09.938Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-103312"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:05:34.210Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}