What’s Vulnerable › Vulnerabilities
CVE-2026-103329: Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-09 · updated 2026-10-09
- Weakness: CWE-347
Description
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.
Affected products
- Super Payments: before 1.43.1 — fixed in 1.43.1
How to fix
Upgrade to a fixed version: Super Payments 1.43.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-103329 or the next vulnerability affects your stack