What’s Vulnerable › Vulnerabilities
CVE-2026-103517: Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-08 · updated 2026-10-08
- Weakness: CWE-345
Description
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
Affected products
- Airwallex Online Payments Gateway: before 1.36.0 — fixed in 1.36.0
How to fix
Upgrade to a fixed version: Airwallex Online Payments Gateway 1.36.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-103517 or the next vulnerability affects your stack