Security Alert Summary
The TiendaCrypto para WooCommerce plugin through 1.2.1 fails to correctly verify the authenticity of its payment webhook. The plugin validates the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
CVE Details
- CVE ID: CVE-2026-103325
- Affected component: TiendaCrypto para WooCommerce WordPress plugin
- Affected versions: Versions through 1.2.1 (inclusive)
- Published: October 27, 2026 at 7:16:31 AM UTC
- Last modified: October 27, 2026 at 3:10:20 PM UTC
- CVSS v3.1: Base score 3.7, severity LOW, vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None; attack complexity: High
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness ID: Not specified
Technical Details
The plugin’s payment webhook verification does not correctly validate incoming notifications. According to the advisory, the signature check is performed against a key that is always empty. As a result, an attacker can forge webhook requests that the plugin will accept as legitimate on web servers that preserve request header case. The vulnerability specifically affects the payment webhook handling logic and arises from using an empty or missing signing key for signature validation.
Impact: An attacker able to send crafted webhook requests can cause the plugin to mark arbitrary WooCommerce orders as paid. The issue relies on servers preserving request header case and the plugin accepting the forged signature due to the empty verification key.
How This Could Impact Your Website
Consider a typical site workflow: the site owner manages the store, internal staff handle order fulfillment, and an external contractor or contributor may assist with integrations. If unauthenticated webhook notifications are accepted as valid, an attacker could mark orders as paid without actual payment. This can lead to shipping unpaid items, accounting and reconciliation errors, and customer confusion. It may also increase the risk of targeted phishing or social engineering if attackers leverage knowledge of fraudulent orders to impersonate staff or suppliers.
If you9re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and any low-privilege accounts with access to order management.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and order logs for unusual behavior, such as unexpected paid status changes or webhook requests from unknown sources.
If you9d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
