---
id: CVE-2026-103327
title: >-
  CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary
  Order Payment Forgery via Empty-Default Webhook Secret
summary: >-
  The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the
  authenticity of the payment notifications received by its gateway callback, as
  the integrity check is skipped while the webhook secret is left at its empty
  def…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-345
product: CryptoCloud
affected:
  - CryptoCloud >= 3.0.0 <= 3.0.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T13:59:07.156305Z'
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T13:59:18.125Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103327'
references:
  - url: 'https://wpscan.com/vulnerability/fd5563ed-85c6-4b17-acf6-bdc2cd77dd4b/'
tags:
  - cve.org
epss: 0.00114
epssPercentile: 0.01512
ingestedAt: '2026-11-05T20:33:06.746Z'
---

## Overview

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.

## Affected

- `CryptoCloud >= 3.0.0 <= 3.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.