{"id":"CVE-2026-103382","title":"Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation","summary":"The Casso Flow  WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"adp","cwe":["CWE-284"],"product":"Casso Flow","affected":["casso_flow < 4.2.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-28T17:50:45.585578Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:58:09.436Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103382","references":[{"url":"https://wpscan.com/vulnerability/2056019e-22bf-4ba1-9b3b-239a369f0219/"}],"tags":["cve.org"],"epss":0.00231,"epssPercentile":0.13999,"ingestedAt":"2026-10-28T07:06:27.166Z","slug":"CVE-2026-103382","body":"## Overview\n\nThe Casso Flow  WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.\n\n## Affected\n\n- `casso_flow < 4.2.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230770,"id":"CVE-2026-103382","ts":1793211382113,"field":"cvss","old":null,"new":"5.3"},{"seq":230769,"id":"CVE-2026-103382","ts":1793211382113,"field":"severity","old":"none","new":"medium"}]}