Read the docs
TI-2026-74638 Aliases CVE-2026-103324GHSA-gpxw-6pc7-r537

Forged payment notices in Cardinity WooCommerce gateway plugin

Priority LOW 29CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

The Cardinity Payment Gateway for WooCommerce WordPress plugin from 3.2.6 before 3.4.2 does not verify the authenticity of the payment notifications it receives. The flaw is CWE-345, insufficient verification of data authenticity, because the secret used to sign these notifications is empty by default. An unauthenticated remote attacker can forge an approved-payment notification to mark arbitrary orders as paid or force them to failed. An exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00125 2nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Cardinity Payment Gateway for WooCommerce (Unknown): 3.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownCardinity Payment Gateway for WooCommerce3.2.6 to before 3.4.23.4.2Patch availableCNA
  • Cardinity Payment Gateway for WooCommerce VendorUnknown Affected 3.2.6 to before 3.4.2 Fixed in 3.4.2 Patch available CNA

Remediation

Update the Cardinity Payment Gateway for WooCommerce plugin to version 3.4.2 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Cardinity Payment Gateway for WooCommerce (Unknown) Fixed in 3.4.2

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-103324
  2. 2026-10-16 Alias added: GHSA-gpxw-6pc7-r537

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences