PT-2026-125879

CVE-2026-103325

·

Published

2026-10-27

·

Updated

2026-10-27

Description by

CVSS 3.1
3.7
Low
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
Exploitability
Exploit
Fix
Researchers
Vendors
Affected products
Related identifiers
CVE-2026-103325
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com