Is CVE-2026-103325 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-103325?

CVE-2026-103325 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-103325

Description

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.