CVE-2026-103329

Name of the Vulnerable Software and Affected Versions Super Payments WordPress plugin versions prior to 1.43.1

Description The plugin fails to properly verify the authenticity of incoming payment webhook notifications. This occurs because the signing key used to validate signatures is empty by default, which allows unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without providing actual payment.

Recommendations Update Super Payments WordPress plugin to version 1.43.1 or later.