CVE-2026-103327

Name of the Vulnerable Software and Affected Versions CryptoCloud versions 3.0.0 through 3.0.1

Description An authentication flaw exists where the plugin fails to verify the authenticity of payment notifications received by its gateway callback. This occurs because the integrity check is skipped when the webhook secret remains at its empty default value, meaning no signature validation is enforced. Consequently, unauthenticated attackers can mark arbitrary WooCommerce orders as paid or failed without performing an actual payment transaction.

Recommendations Update CryptoCloud versions 3.0.0 through 3.0.1 to a version where the integrity check is enforced and the webhook secret is properly configured.