CVE-2026-103382 Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...

CVE-2026-103382

The Casso Flow WordPress plugin, versions prior to 4.2.0 , contains a vulnerability where it fails to properly authenticate incoming bank-transfer payment notifications. On a default installation, the verification token is empty, which allows unauthenticated attackers to forge notifications and m...