CVE-2026-103361
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 15, 2026
Vendor
unknown
Description
The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.