CVE-2026-103517

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying...

CVE-2026-103517 Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying...

EUVD-2026-94827

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying...

CVE-2026-103517

The Airwallex Online Payments Gateway WordPress plugin, in versions prior to 1.36.0 , is vulnerable to an unauthenticated payment bypass. The root cause is a failure to verify the authenticity of incoming payment notifications when no webhook secret is configured. This allows unauthenticated atta...

CVE-2026-103517: Insufficient Verification of Data Authenticity

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying...

MAL-2025-14212 Malicious code in airwallex-online-payments-gateway (npm)

The package airwallex-online-payments-gateway was found to contain malicious code...

Malicious code in airwallex-online-payments-gateway (npm)

The package airwallex-online-payments-gateway was found to contain malicious code...

Malicious code in airwallex-platform-onboarding-sdk-demo-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 503945e9961e51c2bd3819eeedc20ff255058a1873baf46726c646e08f43e2f5 The OpenSSF Package Analysis project identified 'airwallex-platform-onboarding-sdk-demo-react' @ 1.0.0 npm as malicious. It is considered...

MAL-2024-8936 Malicious code in airwallex-platform-onboarding-sdk-demo-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 503945e9961e51c2bd3819eeedc20ff255058a1873baf46726c646e08f43e2f5 The OpenSSF Package Analysis project identified 'airwallex-platform-onboarding-sdk-demo-react' @ 1.0.0 npm as malicious. It is considered...