---
id: CVE-2026-103381
title: >-
  Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation
  via Callback Forgery
summary: >-
  The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the
  authenticity of the payment callback it processes, allowing unauthenticated
  attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to
  dis…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-284
product: Mintpay for WooCommerce
affected:
  - mintpay_for_woocommerce <= 2.2.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-26T10:05:49.144316Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T10:13:35.811Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103381'
references:
  - url: 'https://wpscan.com/vulnerability/593fa052-8917-416c-944b-11b890c9ab50/'
tags:
  - cve.org
ingestedAt: '2026-10-26T07:20:03.484Z'
---

## Overview

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.

## Affected

- `mintpay_for_woocommerce <= 2.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.