CVE-2026-103671: External control of assumed-Immutable web parameter in EC-CUBE CO.,LTD. AmazonPay V2 Plugin (4.0/4.1 series)

The vulnerability CVE-2026-103671 affects the EC-CUBE AmazonPay V2 Plugin for EC-CUBE 4 series. It involves external control of a web parameter that the application assumes to be immutable. Exploitation can redirect users to arbitrary websites during the order process, which may result in attackers obtaining user account information. The CVSS 3.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, limited integrity impact, and no availability impact.

Successful exploitation can redirect users to attacker-controlled websites during the ordering process, potentially leading to the compromise of user account information. There is no direct confidentiality loss of system data, but user integrity is impacted. The vulnerability does not affect system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users of the affected EC-CUBE AmazonPay V2 Plugin versions should monitor vendor communications for updates and apply patches once available.