CVE-2026-103376 Overview
CVE-2026-103376 affects the PeachPay — Payments & Express Checkout for WooCommerce WordPress plugin, which supports Stripe, PayPal, Square, Authorize.net, and NMI. Versions prior to 1.120.70 fail to perform capability or ownership checks before returning an order's secret key in response to unauthenticated requests. An attacker can retrieve the key for any paid order and use it to view customer name, email address, postal address, and order contents. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can harvest personally identifiable information (PII) from any paid WooCommerce order processed by the plugin.
Affected Products
- PeachPay — Payments & Express Checkout for WooCommerce (WordPress plugin)
- All versions before 1.120.70
- WooCommerce sites using PeachPay for Stripe, PayPal, Square, Authorize.net, or NMI checkout
Discovery Timeline
- 2026-10-17 - CVE-2026-103376 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-103376
Vulnerability Analysis
The PeachPay plugin exposes an endpoint that returns an order's secret key without validating the requester's identity or ownership of the order. The secret key then functions as a bearer token that grants read access to order details. Because the endpoint accepts unauthenticated requests, any remote actor can enumerate orders and extract sensitive customer data.
The disclosed data set includes the customer's full name, email address, postal address, and the contents of the order. This information supports downstream phishing, account takeover against the merchant's customer base, and targeted fraud. The confidentiality impact is limited to information disclosure; integrity and availability are not affected.
Root Cause
The plugin's order-retrieval handler omits WordPress capability checks (such as current_user_can()) and does not verify that the requesting session owns the order referenced in the request. The secret key is returned in the HTTP response regardless of authentication state. This design flaw places sole trust in knowledge of the order identifier, which is predictable or enumerable.
Attack Vector
Exploitation requires only network access to the vulnerable WordPress site. An attacker issues an unauthenticated HTTP request referencing a target order identifier and receives the secret key in the response body. The attacker then replays the key against the order-details endpoint to retrieve the associated PII. No user interaction, privileges, or prior authentication is required. See the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-103376
Indicators of Compromise
- Unauthenticated HTTP requests to PeachPay REST endpoints requesting order data by ID
- High-volume sequential or enumerative requests against order identifier parameters
- Repeated responses from the plugin containing order secret keys to anonymous clients
- Access patterns originating from a single IP address iterating across many order IDs
Detection Strategies
- Review WordPress and web server access logs for unauthenticated requests to PeachPay plugin endpoints that return order data
- Monitor for anomalous request bursts against WooCommerce order endpoints that lack authenticated session cookies
- Correlate outbound responses containing order metadata with the absence of a logged-in user context
Monitoring Recommendations
- Enable WordPress audit logging for REST API calls to the PeachPay plugin namespace
- Alert on repeated 200-OK responses to anonymous requests referencing order identifiers
- Track EPSS and vendor advisories for CVE-2026-103376 to prioritize remediation across managed WordPress estates
How to Mitigate CVE-2026-103376
Immediate Actions Required
- Upgrade the PeachPay plugin to version 1.120.70 or later on all affected WordPress sites
- Audit WooCommerce order logs for anonymous access patterns consistent with order ID enumeration
- Notify affected customers if evidence of PII disclosure is identified during log review
Patch Information
The plugin vendor addressed the issue in PeachPay version 1.120.70. The fix enforces capability and ownership validation before returning order secret keys. Site administrators should update through the WordPress plugin dashboard or deploy the patched release via their configuration management pipeline. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Block external access to PeachPay REST endpoints at the web application firewall until the plugin is updated
- Temporarily disable the PeachPay plugin on sites that cannot be patched immediately
- Apply WAF rules that drop unauthenticated requests to WooCommerce order endpoints referencing order identifiers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
