Is CVE-2026-103359 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-103359?

CVE-2026-103359 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-103359

Description

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.