CVE-2026-103308: CWE-345 Insufficient Verification of Data Authenticity in Visma Pay for WooCommerce
Description
A vulnerability in the Visma Pay for WooCommerce WordPress plugin versions before 1.2.2 allows unauthenticated attackers to mark arbitrary orders as paid and access customer information. This occurs because the plugin does not verify the authenticity of payment gateway return requests when the merchant secret is empty, which can happen if the store has not entered its credentials.
CVSS v3.1
Score 6.5medium
Affected software
Visma Pay for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103308 is an insufficient verification of data authenticity vulnerability (CWE-345) in the Visma Pay for WooCommerce plugin prior to version 1.2.2. The plugin relies on a merchant secret to verify payment gateway return requests, but if this secret is empty (such as when credentials are not configured), attackers can exploit this to mark orders as paid without authentication and disclose customer details including name, email, and postal address.
Potential Impact
An attacker can mark arbitrary orders as paid without authentication, potentially leading to fraudulent order processing. Additionally, the attacker can access sensitive customer information such as names, email addresses, and postal addresses, which could lead to privacy violations or further attacks.
Mitigation Recommendations
Upgrade the Visma Pay for WooCommerce plugin to version 1.2.2 or later where this vulnerability is fixed. If upgrading is not immediately possible, ensure that the merchant secret is properly configured and not left empty to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-30T11:35:56.857Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acf5e2e2cdf04f6566e4b1b
Added to database: 10/14/2026, 10:49:18 UTC
Last enriched: 10/14/2026, 11:04:12 UTC
Last updated: 10/14/2026, 11:08:24 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.