Is CVE-2026-103327 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-103327?

CVE-2026-103327 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-103327

Description

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.