Unauthenticated security-check bypass in Pay With MetaMask for WooCommerce plugin up to 1.7.2

Summary

Patchstack disclosed an unauthenticated bypass vulnerability (CVE-2026-107420, CWE-345 insufficient verification of data authenticity) in the WordPress plugin "Pay With MetaMask For WooCommerce - Cryptocurrency Payment Gateway". Patchstack describes it as allowing attackers to get around the plugin's security checks. CVSS 3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected

• cryptocurrency-payments-using-metamask-for-woocommerce (WordPress plugin) <= 1.7.2
• Fixed in 1.7.3

Impact

An unauthenticated remote attacker can bypass a security check in the plugin, with low integrity impact per the CVSS vector. Patchstack rates the issue low priority and "unlikely to be exploited"; no exploitation in the wild is reported.

Recommended actions

• Update the plugin to version 1.7.3 or later
• Merchants using the plugin should reconcile recent crypto-paid orders against on-chain transactions

Source & attribution

This 0xCERT advisory summarises a disclosure by Patchstack (researcher credited: luffy): https://patchstack.com/database/wordpress/plugin/cryptocurrency-payments-using-metamask-for-woocommerce/vulnerability/wordpress-pay-with-metamask-for-woocommerce-cryptocurrency-payment-gateway-plugin-1-7-2-bypass-vulnerability-vulnerability and NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107420. Details may change; refer to the original source for the authoritative record.