-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0306
============================================================

Advisory-ID:  0xCERT-2026-0306
Severity:     Medium
Published:    2026-11-03T09:17:08.000Z
Updated:      2026-11-03T16:42:23.897Z
Chains:       n/a
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0306

Title: CryptoCloud crypto payment gateway WordPress plugin 3.0.0-3.0.1 lets unauthenticated attackers mark orders as paid

Summary
- -------
The CryptoCloud – Crypto Payment Gateway WordPress plugin 3.0.0–3.0.1 skips webhook integrity checks while the webhook secret is at its empty default, so anyone can forge payment notifications and mark orders paid or failed. No fix is known; set a webhook secret and verify payments on-chain.

Details
- -------
Summary
The CryptoCloud – Crypto Payment Gateway plugin for WordPress (slug cryptocloud-crypto-payment-gateway) does not verify the authenticity of payment notifications received by its gateway callback. The integrity check is skipped while the webhook secret is left at its empty default, so unauthenticated attackers can mark arbitrary orders as paid or failed without any payment being made.

Affected
- - cryptocloud-crypto-payment-gateway (WordPress plugin) 3.0.0 through 3.0.1
- - No fix available at time of publication (WPScan lists "No known fix")

Impact
A remote, unauthenticated attacker can send forged payment notifications to the plugin's gateway callback and have orders marked as paid (receiving goods or services without paying in crypto) or marked as failed. CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) per WPScan. WPScan states the proof of concept will be published on November 14, 2026. Exploitation in the wild is not reported by the source.

Recommended actions
- - If you run this plugin, configure a non-empty webhook secret matching your CryptoCloud merchant settings immediately.
- - Reconcile recent orders marked as paid against payments actually received in your CryptoCloud account / on-chain before fulfilling them.
- - Consider disabling the plugin until a fixed version is released, and watch the plugin's changelog for an update.

Source & attribution
This 0xCERT advisory summarises a disclosure by WPScan (original researcher and submitter: Naoki Kawahigashi), published as CVE-2026-103327: https://wpscan.com/vulnerability/fd5563ed-85c6-4b17-acf6-bdc2cd77dd4b/. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://wpscan.com/vulnerability/fd5563ed-85c6-4b17-acf6-bdc2cd77dd4b/
- - CVE-2026-103327
- - https://nvd.nist.gov/vuln/detail/CVE-2026-103327

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrqK4cJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmf74e75GwEyBjy/fTatB3eyhtqXdxhSvScnn3S1
SeJrdxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADYoAD8CrozHSjnWjVmirIk
JP+0CjxFp/AsKAoEpzG+Qo2+f6sA/0LQAiibSaQAGmlYl+fr/O0WnCrE/Aj0
9FX6bGW6rrMM
=/5Jq
-----END PGP SIGNATURE-----