CVE-2026-103361

Payment Gateway via Valitor for WooCommerce < 1.9.41 - Unauthenticated Payment Bypass via a Shipped Default Verification Code

View on CVE.org
Published Nov 15, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.
Title Payment Gateway via Valitor for WooCommerce < 1.9.41 - Unauthenticated Payment Bypass via a Shipped Default Verification Code
References

Subscriptions

No data.

Weaknesses

No weakness.

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Nov 15, 2026, 6:00 AM
Reserved
Sep 30, 2026, 12:50 PM

View source JSON

No data.

No data.

No data.

No data.