CVE-2026-103300: medium-severity vulnerability in Eurobank WooCommerce Payment Gateway
Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.1%
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Eurobank WooCommerce Payment Gatewaypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/37851403-0765-4fc2-80f6-f70d3fc34a88/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.