CVE-2026-103376 PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-103376

The PeachPay — Payments & Express Checkout for WooCommerce WordPress plugin, versions prior to 1.120.70 , is vulnerable to an unauthenticated order key disclosure. The root cause is a lack of capability or ownership checks when the plugin responds to an unauthenticated request by returning an ord...