CVE-2026-103324: Cardinity Payment Gateway Auth Bypass Flaw

CVE-2026-103324 Overview

CVE-2026-103324 affects the Cardinity Payment Gateway for WooCommerce WordPress plugin in versions prior to 3.4.2. The plugin fails to properly verify the authenticity of inbound payment notifications. The signing secret used to validate these notifications is empty by default, which effectively disables signature verification. Unauthenticated attackers can forge approved-payment notifications and mark arbitrary WooCommerce orders as paid. Attackers can also force legitimate orders into a failed state. The flaw is classified under CWE-345: Insufficient Verification of Data Authenticity.

Critical Impact
Unauthenticated remote attackers can forge payment confirmations, manipulate WooCommerce order states, and potentially obtain goods or services without paying.

Affected Products

Cardinity Payment Gateway for WooCommerce WordPress plugin, versions prior to 3.4.2
WooCommerce storefronts running the vulnerable plugin with default configuration
WordPress sites where the Cardinity signing secret has not been manually populated

Discovery Timeline

2026-10-15 - CVE-2026-103324 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-103324

Vulnerability Analysis

The Cardinity Payment Gateway plugin processes asynchronous payment notifications from the Cardinity payment processor. These notifications instruct WooCommerce to transition order states, including marking an order as paid once funds are confirmed. To prevent spoofing, such webhook callbacks must be authenticated through a shared signing secret. The plugin ships with this secret set to an empty value by default. When the secret is empty, the signature verification routine either accepts any value or produces a predictable, forgeable signature. An unauthenticated attacker who knows a valid order identifier can issue a crafted HTTP request to the plugin's notification endpoint. The server treats the request as a genuine payment confirmation and updates the order status accordingly.

Root Cause

The root cause is an insecure default configuration combined with missing enforcement of a non-empty signing secret [CWE-345]. The plugin does not reject notifications when the secret is unconfigured. It also does not require administrators to set the secret before enabling the gateway. This design allows the signature check to pass with attacker-controlled or empty values.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a forged HTTP POST request to the plugin's public callback URL. The request includes a valid WooCommerce order ID and a payment-approved status payload. Order IDs can often be enumerated or inferred from checkout flows. The plugin accepts the forged notification and transitions the order state, enabling fraudulent fulfillment or denial of service against legitimate orders. Refer to the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-103324

Indicators of Compromise

Unexpected transitions of WooCommerce orders to processing or completed status without corresponding entries in Cardinity merchant dashboards.
Legitimate orders unexpectedly moved to failed status shortly after checkout.
Inbound HTTP POST requests to the Cardinity callback endpoint from IP addresses outside Cardinity's documented ranges.
Discrepancies between WooCommerce order totals marked as paid and settled funds reported by the payment processor.

Detection Strategies

Reconcile WooCommerce order status changes against Cardinity transaction logs on a continuous basis to surface forged confirmations.
Inspect web server access logs for repeated POST requests to the plugin's notification URL targeting sequential order IDs.
Alert on order state changes triggered by unauthenticated requests where the signing secret field in plugin configuration is empty.

Monitoring Recommendations

Enable WooCommerce order audit logging and forward events to a centralized SIEM for correlation with web traffic.
Monitor the WordPress wp-admin plugin configuration for the Cardinity gateway and alert when the signing secret is blank.
Track HTTP requests to payment callback endpoints and flag traffic originating outside the payment processor's published IP ranges.

How to Mitigate CVE-2026-103324

Immediate Actions Required

Upgrade the Cardinity Payment Gateway for WooCommerce plugin to version 3.4.2 or later immediately.
Verify that a non-empty, cryptographically strong signing secret is configured in both the plugin settings and the Cardinity merchant portal.
Audit recent WooCommerce orders marked as paid against settlement records in the Cardinity dashboard and reverse any fraudulent fulfillments.

Patch Information

The vendor addressed CVE-2026-103324 in version 3.4.2 of the Cardinity Payment Gateway for WooCommerce plugin. The fix enforces verification of the signing secret and rejects notifications that cannot be authenticated. Site administrators should apply the update through the WordPress plugin management console and confirm that the Cardinity gateway secret has been populated after the upgrade. See the WPScan Vulnerability Report for upgrade guidance.

Workarounds

Disable the Cardinity payment gateway in WooCommerce until the plugin can be updated to 3.4.2 or later.
Restrict access to the plugin's notification endpoint using web application firewall rules that allowlist Cardinity's documented source IP ranges.
Manually set a strong signing secret in both the WordPress plugin configuration and the Cardinity merchant portal to force signature validation on inbound notifications.

bash

# Configuration example: restrict callback endpoint using nginx allowlist
location ~ ^/\?wc-api=cardinity_callback {
    allow <cardinity_ip_range>;
    deny all;
    proxy_pass http://wordpress_backend;
}