{"id":"CVE-2026-103382","aliases":[],"title":"Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"Casso Flow","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"4.2.0","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-103382"}],"remediation":[],"description":"The Casso Flow  WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.","severity":"unknown","score":null,"published":"2026-10-28T06:00:20.631Z","modified":"2026-10-28T17:58:09.436Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/2056019e-22bf-4ba1-9b3b-239a369f0219/"],"sources":[{"name":"CVE","id":"CVE-2026-103382","modified":"2026-10-28T17:58:09.436Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-103382"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:10:31.056Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}