CVE-2026-106027
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 12, 2026
Vendor
unknown
Description
The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.