Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for TiendaCrypto para WooCommerce by Unknown

    CVE-2026-103325 (GCVE-0-2026-103325)

    Vulnerability from nvd – Published: 2026-10-27 06:42 – Updated: 2026-10-27 06:42
    VLAI
    Title
    TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass
    Summary
    The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
    Severity
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1894 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/d19c174c-0032-4f… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown TiendaCrypto para WooCommerce Affected: 1.0.1 , ≤ 1.2.1 (semver)
    		Create a notification for this product.
    Credits
    Naoki Kawahigashi WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unknown",
          "product": "TiendaCrypto para WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "1.2.1",
              "status": "affected",
              "version": "1.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoki Kawahigashi"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T06:42:43.940Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/d19c174c-0032-4f5d-b9be-c4f690e4c8ca/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-103325",
    "datePublished": "2026-10-27T06:42:43.940Z",
    "dateReserved": "2026-09-30T12:30:57.200Z",
    "dateUpdated": "2026-10-27T06:42:43.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103325 (GCVE-0-2026-103325)

    Vulnerability from cvelistv5 – Published: 2026-10-27 06:42 – Updated: 2026-10-27 06:42
    VLAI
    Title
    TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass
    Summary
    The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
    Severity
    3.7 (Low)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
    CWE
    Assigner
    WPScan CNA under the mitre root
    CNA scorecard E 44/100 over 1894 records in the last 180 days details
    References
    URL Tags
    https://wpscan.com/vulnerability/d19c174c-0032-4f… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown TiendaCrypto para WooCommerce Affected: 1.0.1 , ≤ 1.2.1 (semver)
    		Create a notification for this product.
    Credits
    Naoki Kawahigashi WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unknown",
          "product": "TiendaCrypto para WooCommerce",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "1.2.1",
              "status": "affected",
              "version": "1.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoki Kawahigashi"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T06:42:43.940Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/d19c174c-0032-4f5d-b9be-c4f690e4c8ca/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-103325",
    "datePublished": "2026-10-27T06:42:43.940Z",
    "dateReserved": "2026-09-30T12:30:57.200Z",
    "dateUpdated": "2026-10-27T06:42:43.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}