TI-2026-70522 Aliases CVE-2026-107420 GHSA-r373-5w22-cc56

Unauthenticated bypass in Pay With MetaMask For WooCommerce plugin

LOW 29CWE-345Published 2026-10-10 · Updated 2026-10-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

The Pay With MetaMask For WooCommerce plugin by Narinder Singh, up to and including 1.7.2, does not sufficiently verify data authenticity (CWE-345). An unauthenticated remote attacker can bypass a check in the plugin over the network, with a low impact on data integrity.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00124 2nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cool Plugins	Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway	up to 1.7.2	—	No fix listed	CNA

Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway VendorCool Plugins Affected up to 1.7.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Pay With MetaMask For WooCommerce.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-11 Threatist record created from CVE-2026-107420
2026-10-11 Alias added: GHSA-r373-5w22-cc56

References

Other 1

https://patchstack.com/database/wordpress/plugin/cryptocurrency-payments-using-metamask-for-woocommerce/vulnerability/wordpress-pay-with-metamask-for-woocommerce-cryptocurrency-payment-gateway-plugin-1-7-2-bypass-vulnerability-vulnerability?_s_id=cve

TI-2024-35937 WordPress Cryptocurrency Widgets For Elementor plugin <= 1.6.4 - Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
TI-2024-00651 SQL injection in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List CVSS 3.1CRITICAL 9.8
TI-2023-18496 WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin <= 2.6.2 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
TI-2022-04540 Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation CVSS 3.1HIGH 8.8
TI-2023-28579 WordPress Events Shortcodes & Templates For The Events Calendar Plugin <= 2.3.1 is vulnerable to SQL Injection CVSS 3.1HIGH 8.8
TI-2021-03206 Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery CVSS 3.1HIGH 8.8

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences