Security Alert Summary
The Mintpay for WooCommerce plugin through 2.2.3 does not verify the authenticity of the payment callback it processes. This omission allows unauthenticated attackers to mark arbitrary orders as paid, cancel orders, and disclose order details including customer contact information.
CVE Details
- CVE ID: CVE-2026-103381
- Affected component: Mintpay for WooCommerce WordPress plugin
- Affected versions: through 2.2.3 (less than or equal to 2.2.3)
- Published: October 26, 2026 at 07:17:07 AM
- Last modified: October 26, 2026 at 01:50:14 PM
- CVSS v3.1 base score: 6.5
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Authentication / privileges / user interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-284
Technical Details
The plugin fails to verify the authenticity of the payment callback it processes. Because the callback is not authenticated or validated, an unauthenticated actor can submit crafted callback requests that the plugin accepts as legitimate. As described in the vulnerability data, this allows an attacker to:
- Mark arbitrary orders as paid
- Cancel arbitrary orders
- Obtain order details, including customer contact information
The root cause is the lack of verification for incoming payment callback requests. No specific functions or REST endpoints are named in the available data; the description focuses on the missing authenticity checks for payment callbacks. The practical impact is unauthorized modification of order state and disclosure of order-related data, without evidence in the provided data of broader system compromise.
How This Could Impact Your Website
In a typical small business WordPress site running WooCommerce, multiple roles interact with orders: the site owner, internal staff handling fulfillment, and external contractors or contributors who may have limited administrative access. An attacker exploiting this vulnerability could submit unauthenticated callbacks that cause the site to mark orders as paid. Staff may then ship goods, refund, or otherwise act on forged order statuses. The same flaw could expose customer contact information from order records, increasing the risk of targeted phishing or social engineering attempts against customers or staff.
For example, an attacker could mark low-value orders as paid to test behavior, then access order contact details to send convincing phishing emails to customers. Internal staff could be misled by falsified payment notifications and take operational actions based on incorrect order states.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and shop manager roles that can view or modify orders.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and order logs for unusual behavior, such as unexpected status changes or repeated payment callbacks from the same source.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
