[ CVE-2026-103313 · Published 28 Oct 2026 ]
Vulnerability in Unknown BitPay Gateway for WooCommerce
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.