CVE-2026-103300Medium· 5.3▾ SunlitThe Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by def…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
eurobank_woocommerce_payment_gateway <= 2.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-31356NoneInsufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure
CVE-2026-116254Medium· 6.5rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation
CVE-2026-116116High· 8.2Yoosee GM8135S Camera Secure Boot signature verification
CVE-2026-115183Low· 2.4Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
CVE-2026-115933Critical· 9.9Forged signed tokens let any registered user take over other users and organizations
CVE-2026-115937High· 7.5Unauthenticated payment reuse allows unpaid orders to be marked as paid