CVE-2026-103332

{
  "etk_id": "ETK-2026-2730",
  "cve_id": "CVE-2026-103332",
  "display_id": "CVE-2026-103332",
  "ghsa_id": "GHSA-qxp3-7pvj-q7qx",
  "euvd_id": "EUVD-2026-110607",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Payment notification authentication flaw in Payex Payment Gateway",
  "summary": "Payex Payment Gateway for WooCommerce through 1.2.10 may accept payment notifications without reliably verifying their origin when its validation secret remains at the default empty value. An unauthenticated remote attacker could cause orders to be recorded as paid under that condition.",
  "mitigation": "Set a non-empty, unique validation secret for payment notifications immediately and confirm that notification authentication is enforced. Monitor for and apply a vendor update, as no fixed version is recorded.",
  "vendor": null,
  "product": "Payex Payment Gateway for Woocommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.2.10"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Payex Payment Gateway for Woocommerce",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 24.10678385,
  "t0_at": "2026-10-27T06:00:19.925000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T06:00:19.925000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T06:00:19.925000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103332"
    }
  }
}