---
id: CVE-2026-103372
title: Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure
summary: >-
  The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is
  allowed to see an order before returning its confirmation link, allowing
  unauthenticated users to obtain any paid order's key and, for recent guest
  orders, view…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: Payconiq
affected:
  - Payconiq <= 1.0.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T17:50:55.618504Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:09.601Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103372'
references:
  - url: 'https://wpscan.com/vulnerability/19956956-b66f-47e6-9038-29d38283589a/'
tags:
  - cve.org
epss: 0.00262
epssPercentile: 0.18107
ingestedAt: '2026-10-28T07:06:27.171Z'
---

## Overview

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.

## Affected

- `Payconiq <= 1.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.