Three WooCommerce payment callback CVEs: check payment state and update affected plugins
Three WooCommerce gateway CVEs published on 26 October 2026 can permit forged payment-status callbacks. Verify installed plugins, update iK Pay to 3.0.4+, and disable the other affected gateways until a vendor fix is verified.
Scope
Three WooCommerce gateway CVEs published on 26 October 2026 can permit forged payment-status callbacks. Verify installed plugins, update iK Pay to 3.0.4+, and disable the other affected gateways until a vendor fix is verified.
Status: confirmed — 27 October 2026
CVE-2026-103298 (CCAvenue Payment Gateway for WooCommerce through 3.1), CVE-2026-103300 (Eurobank WooCommerce Payment Gateway through 2.1.1), and CVE-2026-103306 (Online Payments with iK Pay Gateway before 3.0.4).
Publication date: 26 October 2026 for all three. CVSS v3.1: 5.3 for each. EPSS: unavailable in records checked 27 October. Exploitation: not confirmed; CISA SSVC recorded exploitation “none” on 26 October. CISA KEV: not listed in the 26 October catalogue. Urgency: High where an affected gateway is enabled.
What is confirmed
These WooCommerce plugins can accept a payment callback without reliably proving it came from the payment provider. CVE-2026-103298 describes CCAvenue through 3.1 deriving its verification key from an empty default value. CVE-2026-103300 describes Eurobank through 2.1.1 shipping with an empty default secret. Both can allow a pending order to be marked paid or failed. CVE-2026-103306 affects iK Pay before 3.0.4 and can allow forged successful or failed payment notifications.
The NVD records and linked WPScan disclosures confirm the product/version bounds above. They do not confirm a compromise at any particular shop, public exploitation, or a CISA KEV listing. This is a payment-integrity risk, not a claim of server takeover.
Are you affected?
Do not send or replay a payment callback. In WordPress, open Plugins → Installed Plugins and record the exact version and active state for CCAvenue, Eurobank and iK Pay. Then open WooCommerce → Settings → Payments and record whether the corresponding gateway is enabled and whether its provider credentials/secrets are configured.
An installed affected version with an enabled gateway is potentially affected. An absent or disabled plugin is not exposed through that plugin. A configured secret does not prove CVE-2026-103298 or CVE-2026-103300 is fixed: the reports describe callback verification defects.
Retain plugin inventory, gateway settings evidence where permitted, WooCommerce order logs and provider settlement records. A paid WooCommerce order with no matching provider transaction is an investigation lead, not proof that a CVE was used.
NetTools.tech: no safe relevant check exists. An external scan cannot establish a private plugin version or whether callback authentication is correct.
Patch and containment
CVE-2026-103306: update iK Pay
Prerequisites: tested backup/restore, access to the provider portal and an approved change window.
- Go to Plugins → Installed Plugins and find Online Payments with iK Pay Gateway.
- Install 3.0.4 or later using the normal WordPress update channel; do not upload an unverified third-party ZIP.
- In WooCommerce → Settings → Payments, confirm merchant credentials and the provider callback URL.
- Use the provider’s supported sandbox/test mode for a low-value authorised test order, then reconcile it in the provider portal.
Expected result: WordPress reports 3.0.4 or later and a legitimate test transaction obtains the expected order status. Validate with the installed-version screen and provider settlement record.
Rollback: if checkout fails, revert through the tested change procedure only long enough to recover service, disable the gateway and use another supported method. The prior affected version must not remain enabled.
CVE-2026-103298 and CVE-2026-103300: no verified fixed version
The consulted CVE/WPScan records say “through” the affected versions but do not name a fixed release. Do not assume one.
- In WooCommerce → Settings → Payments, disable the relevant gateway.
- In Plugins → Installed Plugins, deactivate the matching plugin.
- Contact the plugin maintainer and payment provider through their official support route for a release that explicitly addresses the CVE and provider-approved callback controls.
- Use a maintained provider-approved replacement gateway; reconcile orders created while the affected gateway was enabled.
Expected result: the gateway is unavailable at checkout and the plugin shows inactive. Validate in a normal customer session and with a permitted replacement-gateway test transaction.
Rollback: re-enable only after a vendor-supported fixed version is installed and a legitimate transaction is reconciled. Re-enabling an affected release restores the risk.
Safe review and interpretation
Compare WooCommerce order status with the payment provider’s transaction list. Preserve order IDs, timestamps, gateway logs and relevant web-server logs before changing plugins. If an order is paid without a matching provider transaction, pause fulfilment, preserve evidence and contact the provider’s fraud/support team. The disclosures do not establish credential theft; credential rotation is a provider-guided containment decision, not a fix for callback verification.
CISA KEV absence is not proof of safety. Prioritise live internet-facing checkout, order value and the availability of a supported replacement—not CVSS alone.
Timeline
- 26 October 2026: NVD published CVE-2026-103298, CVE-2026-103300 and CVE-2026-103306.
- 26 October 2026: CISA SSVC recorded exploitation “none” for the three records.
- 27 October 2026: current NVD and CISA KEV status reviewed.
Changes log
- 27 October 2026 — r1: Initial publication; recorded publication dates, affected versions, SSVC/KEV status and remediation limits.