CryptoCloud crypto payment gateway WordPress plugin 3.0.0-3.0.1 lets unauthenticated attackers mark orders as paid

Summary

The CryptoCloud – Crypto Payment Gateway plugin for WordPress (slug cryptocloud-crypto-payment-gateway) does not verify the authenticity of payment notifications received by its gateway callback. The integrity check is skipped while the webhook secret is left at its empty default, so unauthenticated attackers can mark arbitrary orders as paid or failed without any payment being made.

Affected

• cryptocloud-crypto-payment-gateway (WordPress plugin) 3.0.0 through 3.0.1
• No fix available at time of publication (WPScan lists "No known fix")

Impact

A remote, unauthenticated attacker can send forged payment notifications to the plugin's gateway callback and have orders marked as paid (receiving goods or services without paying in crypto) or marked as failed. CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) per WPScan. WPScan states the proof of concept will be published on November 14, 2026. Exploitation in the wild is not reported by the source.

Recommended actions

• If you run this plugin, configure a non-empty webhook secret matching your CryptoCloud merchant settings immediately.
• Reconcile recent orders marked as paid against payments actually received in your CryptoCloud account / on-chain before fulfilling them.
• Consider disabling the plugin until a fixed version is released, and watch the plugin's changelog for an update.

Source & attribution

This 0xCERT advisory summarises a disclosure by WPScan (original researcher and submitter: Naoki Kawahigashi), published as CVE-2026-103327: https://wpscan.com/vulnerability/fd5563ed-85c6-4b17-acf6-bdc2cd77dd4b/. Details may change; refer to the original source for the authoritative record.