CVE-2026-103376 in PeachPay Plugin
Summary
by MITRE • 10/17/2026
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in PeachPay — Payments & Express Checkout for WooCommerce prior to version 1.120.70 represents a critical failure in access control mechanisms within the plugin’s API implementation. This flaw allows unauthenticated actors to retrieve sensitive order data by exploiting the lack of proper authorization checks when requesting secret keys associated with specific orders. The root cause lies in the absence of capability or ownership verification before the system processes requests for these cryptographic tokens, which are intended to be restricted to authorized users only.
From a technical perspective, the vulnerability stems from an insecure direct object reference pattern where the application fails to validate whether the requesting user has legitimate permission to access the requested resource. When an unauthenticated request is made with a valid order identifier, the server responds by returning the associated secret key without verifying if the requester owns that order or possesses administrative privileges. This behavior violates fundamental security principles regarding data confidentiality and integrity, as it exposes internal operational secrets to external parties who should not have access.
The operational impact of this vulnerability is significant due to the sensitive nature of the information accessible through these retrieved keys. Once an attacker obtains a secret key for any paid order, they can use it to view comprehensive customer details including names, email addresses, postal addresses, and specific contents of purchases. This exposure facilitates potential identity theft, targeted phishing campaigns, or further exploitation of compromised accounts. The ability to access such data without authentication undermines trust in the e-commerce platform and exposes businesses to regulatory compliance risks under frameworks like GDPR or CCPA due to unauthorized disclosure of personally identifiable information.
This vulnerability aligns with CWE-284 Improper Access Control as it involves a failure to enforce proper restrictions on authenticated users regarding access to resources, specifically allowing unauthenticated access where authentication should be required. Additionally, the exploitation technique corresponds to ATT&CK T1078 Valid Accounts and potentially T1539 Steal Web Session Cookie depending on how the secret key is utilized in subsequent attacks, although primarily it represents a direct data exfiltration vector through broken object level authorization principles common in RESTful API implementations.
Mitigation strategies must focus on implementing robust authentication and authorization checks at every endpoint that handles sensitive order-related operations. Developers should ensure that all requests for secret keys or similar credentials require valid session tokens or administrative privileges before processing the response. Input validation alone is insufficient; server-side verification of user permissions relative to the requested resource ID is essential. Upgrading to version 1.120.70 or later resolves this issue by enforcing these necessary checks, thereby preventing unauthorized retrieval of order-specific secrets and protecting customer data from exposure through unauthenticated API calls.