CVE-2026-103331 UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret

The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark...

CVE-2026-103331

The UniPAY Payment Gateway For WooCommerce WordPress plugin, in versions through 2.3 , contains a vulnerability where it fails to properly verify the authenticity of payment notifications. The root cause is that signatures are checked against a merchant secret which is empty by default. This flaw...