Untrusted web parameter in EC-CUBE AmazonPay Plugin enables redirects
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The EC-CUBE AmazonPay V2 Plugin and the EC-CUBE AmazonPay Plugin (4.0 series) are affected in several version ranges. The plugin trusts a web parameter it assumes cannot change, and an attacker can control it (CWE-472). If exploited, the user may be redirected to an arbitrary website during the ordering process, and the user's account information may be obtained.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| EC-CUBE CO.,LTD. | AmazonPay V2 Plugin (4.0/4.1 series) | v1.1.7 – v1.1.12 | — | No fix listed | CNA |
| EC-CUBE CO.,LTD. | AmazonPay V2 Plugin (4.0/4.1 series) | v1.0.0 – v1.1.6 | — | No fix listed | CNA |
| EC-CUBE CO.,LTD. | AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition) | v4.3.1 | — | No fix listed | CNA |
| EC-CUBE CO.,LTD. | AmazonPay V2 Plugin (4.2/4.3 series) | v4.2.3 – v4.3.1 | — | No fix listed | CNA |
| EC-CUBE CO.,LTD. | AmazonPay V2 Plugin (4.2/4.3 series) | v4.2.0 – v4.2.2 | — | No fix listed | CNA |
| EC-CUBE CO.,LTD. | AmazonPay Plugin (4.0 series) | up to v1.3.0 | — | No fix listed | CNA |
- AmazonPay V2 Plugin (4.0/4.1 series) VendorEC-CUBE CO.,LTD. Affected v1.1.7 – v1.1.12 Fixed in — No fix listed CNA
- AmazonPay V2 Plugin (4.0/4.1 series) VendorEC-CUBE CO.,LTD. Affected v1.0.0 – v1.1.6 Fixed in — No fix listed CNA
- AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition) VendorEC-CUBE CO.,LTD. Affected v4.3.1 Fixed in — No fix listed CNA
- AmazonPay V2 Plugin (4.2/4.3 series) VendorEC-CUBE CO.,LTD. Affected v4.2.3 – v4.3.1 Fixed in — No fix listed CNA
- AmazonPay V2 Plugin (4.2/4.3 series) VendorEC-CUBE CO.,LTD. Affected v4.2.0 – v4.2.2 Fixed in — No fix listed CNA
- AmazonPay Plugin (4.0 series) VendorEC-CUBE CO.,LTD. Affected up to v1.3.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for the EC-CUBE AmazonPay V2 Plugin or the EC-CUBE AmazonPay Plugin.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-14 Threatist record created from CVE-2026-103671
- 2026-10-14 Alias added: GHSA-9xxh-8f25-hpwm
- 2026-10-14 CISA SSVC decision points changed
References
More EC-CUBE CO.,LTD. vulnerabilities
- TI-2014-00744 Authorization bypass in EC-CUBE CVSS 3.1CRITICAL 9.1
- TI-2016-04180 SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows… CVSS 3.1CRITICAL 9.8
- TI-2022-17420 Unrestricted file upload in EC-CUBE CO.,LTD. Product Image Bulk Upload Plugin CVSS 3.1CRITICAL 9.8
- TI-2020-04559 Path traversal in EC-CUBE CVSS 3.1HIGH 8.1
- TI-2023-25304 Code injection in EC-CUBE 4 series CVSS 3.1HIGH 7.2
- TI-2021-04004 Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote… CVSS 3.1HIGH 7.5
Sources
- CVE-2026-103671 · CVE Program
- CVE-2026-103671 · NVD
- FIRST EPSS
- GHSA-9xxh-8f25-hpwm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences