CVE-2026-103382

Name of the Vulnerable Software and Affected Versions Casso Flow versions prior to 4.2.0

Description The plugin fails to properly authenticate incoming bank-transfer payment notifications because the verification token is empty by default. This allows unauthenticated attackers to forge notifications and update the status of any pending WooCommerce order to paid, regardless of the payment method used. The issue stems from a missing capability check in a function used to process these updates.

Recommendations Update to version 4.2.0 or later.