CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103361
UNKNOWNCVSS 0NVD feed
Published 15 November 2026 · tracked since 15 November 2026
Description
The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog