CVE-2026-103313: medium-severity vulnerability in BitPay Gateway for WooCommerce
BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.2%
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · BitPay Gateway for WooCommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/feaebdbf-cfa2-49cf-a8be-d2f22b0ad9c9/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.