{"id":"CVE-2026-103331","aliases":[],"title":"UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"UniPAY Payment Gateway For WooCommerce","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.3","versionType":"semver"}],"defaultStatus":"unknown","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-103331"}],"remediation":[],"description":"The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.","severity":"unknown","score":null,"published":"2026-10-28T06:00:19.793Z","modified":"2026-10-28T17:58:09.780Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/a7d61b5f-9e92-459c-8f6d-1c92ea94ef00/"],"sources":[{"name":"CVE","id":"CVE-2026-103331","modified":"2026-10-28T17:58:09.780Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-103331"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:30:46.166Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}