WordPress Cardinity Payment Gateway for WooCommerce plugin 3.2.6-3.4.1 - Unauthenticated Arbitrary Order Payment Forgery vulnerability

Unauthenticated Arbitrary Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Cardinity Payment Gateway for WooCommerce versions 3.2.6-3.4.1...

CVE-2026-103324

The Cardinity Payment Gateway for WooCommerce WordPress plugin versions prior to 3.4.2 is vulnerable to unauthenticated payment notification forgery. The root cause is that the plugin does not properly verify the authenticity of received notifications because the signing secret is empty by defaul...