CVE-2026-103329

Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.

Affected

Super Payments

CVSS v3.1 WPSCAN

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.13% chance of exploitation in the next 30 days, 2nd percentile

Published

2026-10-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/aefba87d-fa4c-4b7c-9436-6e79e966e8a5/

References

• CVE Record
• NVD entry