CVE-2026-103381
Last modified
CVE-2026-103381 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information..
Description
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Mintpay for WooCommerce | <= 2.2.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-103381?
How severe is CVE-2026-103381?
How do I fix CVE-2026-103381?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-103371Insertion of Sensitive Information into Log File in Apache G…7.5
- CVE-2026-103372The Payconiq WordPress plugin through 1.0.4 does not check t…5.3
- CVE-2026-103376The PeachPay — Payments & Express Checkout for WooCommerce (…5.3
- CVE-2026-103377A reflected Cross-Site Scripting (XSS) vulnerability has bee…5.1
- CVE-2026-103378The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3…6.5
- CVE-2026-103380The Appointment Booking Plugin – LatePoint | Calendar & Sche…4.3
- CVE-2026-103382The Casso Flow WordPress plugin before 4.2.0 does not prope…5.3
- CVE-2026-103387A weakness has been identified in garycourt uri-js up to 4.4…4.3
- CVE-2026-103388MISP renders the source field of a Galaxy Cluster as a click…6.2
- CVE-2026-103389MISP contains a stored cross-site scripting (XSS) vulnerabil…6.2
- CVE-2026-103390An Out-of-Bounds Read vulnerability in the HttpParser compon…5.3
- CVE-2026-103391An Out-of-bounds Write vulnerability in the SSR TCP proxy/op…5.3
Are you affected by CVE-2026-103381?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST