---
id: CVE-2026-103301
title: >-
  Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation
  Forgery via Empty-Default Merchant Secret
summary: >-
  The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify
  the authenticity of incoming payment notifications, because the secret used to
  sign them is empty by default, allowing unauthenticated attackers to forge a
  val…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-345
product: Payment Gateway for Telcell
affected:
  - payment_gateway_for_telcell < 2.0.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-21T10:12:01.022457Z'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T10:14:55.631Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103301'
references:
  - url: 'https://wpscan.com/vulnerability/c3b5f5fb-cddf-47f3-b39f-8bcd2c738c83/'
tags:
  - cve.org
ingestedAt: '2026-10-21T09:46:15.400Z'
---

## Overview

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.

## Affected

- `payment_gateway_for_telcell < 2.0.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.