CVE-2026-103325 Details
Description
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
A vulnerability exists in the TiendaCrypto para WooCommerce WordPress plugin, affecting versions through 1.2.1. The issue arises because the plugin fails to properly verify the authenticity of payment webhooks. It validates the request signature against an always-empty key, allowing unauthenticated attackers to forge webhook notifications. This exploitation can result in arbitrary WooCommerce orders being marked as paid, particularly on servers that maintain the case of request headers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/d19c174c-0032-4f5d-b9be-c4f690e4c8ca/ | [email protected] | AdvisoryExploitPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| TiendaCrypto | >= 1.0.1, <= 1.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |