CVE-2026-103298
waiting for further signalsZero needs more public information before it can validate it.description
CCAvenue Payment Gateway for WooCommerce through version 3.1 does not reliably authenticate payment-confirmation requests. An unauthenticated remote attacker may cause WooCommerce orders to be marked paid when the plugin retains its default empty verification-key setting.
mitigation
Ensure the plugin's payment-verification key is not left empty, and verify payment status with the provider before fulfilling orders. No fixed version is recorded; restrict or disable the affected payment workflow if that setting cannot be secured.
outcome
Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-26 06:00Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-103298
{ "etk_id": "ETK-2026-2629", "cve_id": "CVE-2026-103298", "display_id": "CVE-2026-103298", "ghsa_id": null, "euvd_id": "EUVD-2026-109618", "status": "published", "anchor_state": "anchored", "title": "Authentication bypass in CCAvenue Payment Gateway for WooCommerce", "summary": "CCAvenue Payment Gateway for WooCommerce through version 3.1 does not reliably authenticate payment-confirmation requests. An unauthenticated remote attacker may cause WooCommerce orders to be marked paid when the plugin retains its default empty verification-key setting.", "mitigation": "Ensure the plugin's payment-verification key is not left empty, and verify payment status with the provider before fulfilling orders. No fixed version is recorded; restrict or disable the affected payment workflow if that setting cannot be secured.", "vendor": null, "product": "CCAvenue Payment Gateway for WooCommerce", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 3.1" ], "ecosystem": null, "fixed_versions": [], "package_name": "CCAvenue Payment Gateway for WooCommerce", "purl": null } ], "cwes": null, "cvss_score": null, "cvss_src": null, "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 35.32288621666667, "t0_at": "2026-10-26T06:00:18.034000+00:00", "signals": { "trigger_signal": { "at": "2026-10-26T06:00:18.034000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-26T06:00:18.034000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103298" } } }
published 2026-10-26 06:41Z
last change 2026-10-26 09:21Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.