Unauthenticated order key disclosure in PeachPay WooCommerce plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.
Summary
The PeachPay WordPress plugin for WooCommerce, from 1.117.9 before 1.120.70, is affected. It does not check capability or ownership before returning an order's secret key, which is CWE-200 exposure of sensitive information. An unauthenticated remote attacker can retrieve the key for any paid order and use it to view the customer's name, email address, postal address and order contents. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) | 1.117.9 to before 1.120.70 | 1.120.70 | Patch available | CNA |
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) VendorUnknown Affected 1.117.9 to before 1.120.70 Fixed in 1.120.70 Patch available CNA
Remediation
Upgrade PeachPay to version 1.120.70, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) (Unknown) Fixed in 1.120.70
Timeline
- 2026-10-18 Threatist record created from CVE-2026-103376
- 2026-10-18 Alias added: GHSA-pvfc-2cxg-992w
References
Sources
- CVE-2026-103376 · CVE Program
- CVE-2026-103376 · NVD
- FIRST EPSS
- GHSA-pvfc-2cxg-992w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences