CVE-2026-103329 in Super Payments Plugin
Summary
by MITRE • 10/09/2026
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Super Payments WordPress plugin versions prior to 1.43.1 represents a critical failure in authentication logic within the webhook processing mechanism. Webhooks are commonly used by e-commerce platforms like WooCommerce to receive real-time notifications from third-party payment gateways regarding transaction statuses, such as success or failure. The security model for these webhooks typically relies on cryptographic signature verification, where the receiving server validates that the incoming request originated from a trusted source using a shared secret key. In this specific implementation, the default configuration leaves the signing key empty or null. This design flaw fundamentally breaks the integrity check because an empty key allows any string to pass validation logic, effectively rendering the authentication mechanism non-functional. Consequently, the system fails to distinguish between legitimate requests originating from the payment provider and malicious requests crafted by external attackers.
From a technical perspective, this issue falls under CWE-287 Improper Authentication, as the application does not adequately verify the identity of the user or service attempting to access resources. The attacker can exploit this weakness by constructing HTTP POST requests that mimic legitimate webhook payloads from payment gateways such as Stripe or PayPal. By manipulating fields within these payloads, specifically those indicating order status and amount paid, an adversary can force the WooCommerce backend to update specific orders with a completed payment state without any actual financial transaction occurring. This bypasses the standard checkout flow entirely, allowing for immediate access to digital goods or services that are released upon successful payment confirmation. The exploit requires no prior authentication credentials, making it accessible to unauthenticated remote attackers who discover the endpoint through common vulnerability scanning techniques or directory enumeration.
The operational impact of this vulnerability is severe for businesses relying on WooCommerce and Super Payments for their revenue generation. Attackers can engage in fraud by acquiring high-value digital products, subscriptions, or services without paying for them. This results in direct financial loss equal to the value of the goods obtained through exploitation. Furthermore, it introduces significant administrative overhead as merchants must manually identify fraudulent orders, reverse transactions with payment processors if possible, and manage customer disputes arising from unauthorized access to paid content. The integrity of sales data is also compromised, leading to inaccurate revenue reporting and potential compliance issues regarding financial record-keeping. In environments where digital goods are delivered instantly upon order completion, the exploitation can occur at scale, causing widespread inventory depletion or service abuse before the vulnerability is detected and patched.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary and most effective solution is to upgrade the Super Payments plugin to version 1.43.1 or later, where this authentication flaw has been resolved by enforcing strict signature verification with a properly configured secret key. Administrators should ensure that webhook endpoints are not publicly accessible without proper validation mechanisms in place during any interim period before patching. Additionally, implementing network-level controls such as IP whitelisting for known payment gateway addresses can provide an additional layer of defense, although this is less robust than cryptographic verification due to the potential for IP spoofing or changes in provider infrastructure. Security teams should also audit webhook endpoints across their WordPress installations to ensure that no other plugins suffer from similar misconfigurations regarding secret key management and signature validation logic.
This vulnerability aligns with MITRE ATT&CK technique T1496, which involves Resource Hijacking for financial gain through unauthorized access or exploitation of system resources. The attack vector is classified as Remote (Network) via CWE-352 Cross-Site Request Forgery principles applied to API endpoints, although it is more accurately described as a Broken Access Control issue where the server trusts unverified input data regarding transaction status. Organizations should prioritize patching this vulnerability immediately due to its low barrier to entry and high potential for financial fraud. Regular security audits of third-party WordPress plugins are essential to identify similar weaknesses in authentication flows, particularly those involving external integrations that handle sensitive state changes such as payment processing.