---
id: CVE-2026-103319
title: >-
  OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment
  Confirmation Forgery via Empty Default Secret Key
summary: >-
  The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does
  not properly verify that payment notifications originate from the payment
  provider, as the secret used to validate their signature is empty by default,
  allowing…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-287
product: OPay Payment Gateway for WooCommerce
affected:
  - opay_payment_gateway_for_woocommerce <= 2.5.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-26T10:05:36.943697Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T10:13:35.664Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103319'
references:
  - url: 'https://wpscan.com/vulnerability/c07f15a0-3c15-429f-bcde-1511ad658c6c/'
tags:
  - cve.org
ingestedAt: '2026-10-26T07:20:03.483Z'
---

## Overview

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

## Affected

- `opay_payment_gateway_for_woocommerce <= 2.5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.