5.3
MediumCVSS 3.1 · from CISA
CVE-2026-103299
nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret
Payment Gateway · Improper authentication · CWE-287AffectedPayment Gateway
FixNo fix listed yet.
PublishedOct 26, 06:00 · WPScan
Scored5.3 · CISA
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.
From WPScan
Affected and fixed versions
ProductAffectedFixed inPayment Gatewayup to 2.2.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known