PT-2026-107880

CVE-2026-103517

Published

2026-10-06

Updated

2026-10-08

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Airwallex Online Payments Gateway versions prior to 1.36.0

Description An issue exists where the plugin fails to verify that incoming payment notifications are authentic when no webhook secret is configured. This lack of server-side payment verification allows unauthenticated attackers to forge notifications and mark orders as paid without completing the actual payment.

Recommendations Update to version 1.36.0 or later. Configure a webhook secret to ensure payment notifications are verified.

Exploitability

Exploit

Fix

Impacts

Researchers

Pedro Pinho

Vendors

Affected products

Weakness enumeration

CWE-345: Insufficient Verification of Data Authenticity

Related identifiers