CVE-2026-103301: CWE-345 Insufficient Verification of Data Authenticity in Payment Gateway for Telcell

CVE-2026-103301 describes a weakness in the Payment Gateway for Telcell WordPress plugin prior to version 2.0.5. The plugin fails to verify the authenticity of incoming payment notifications because the signing secret is empty by default. This insufficient verification (CWE-345) allows attackers without authentication to forge payment notifications. Attackers can exploit this to mark any WooCommerce order as paid or, alternatively, mark an order as failed by submitting an invalid signature. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity loss without confidentiality or availability impact.

An attacker can manipulate order statuses in WooCommerce by forging payment notifications, potentially causing financial and operational disruption by marking unpaid orders as paid or marking legitimate orders as failed. There is no direct confidentiality or availability impact reported.

A fixed version 2.0.5 or later is implied but not explicitly confirmed in the provided data. Since no patch links or vendor advisories are included, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, users should verify the configuration of the signing secret to ensure it is not empty and consider additional validation of payment notifications.