CVE-2026-103312

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to...

CVE-2026-103312 Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to...

WordPress Payment Integration Wompi plugin <= 4.0.1 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payment Integration Wompi versions = 4.0.1...

CVE-2026-103312

The Payment Integration Wompi WordPress plugin version 4.0.1 and below is vulnerable to an unauthenticated payment confirmation forgery. The root cause is that the plugin fails to verify the authenticity of incoming payment notifications on a stock installation because the callback checksum is ke...

EUVD-2026-110608

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to...