CVE-2026-103671 EC-CUBE CO.,LTD. CVE debrief

Who should care

EC-CUBE users with the AmazonPay Plugin or V2 Plugin installed, especially those with versions prior to v1.1.13 or v4.3.2, should assess potential exposure and verify their versions.

Why it matters

CVE-2026-103671 is an external control of assumed-immutable web parameter issue in the EC-CUBE AmazonPay Plugin, which may allow redirects to arbitrary websites during ordering, potentially exposing user account information. Defenders should prioritize verifying exposure for EC-CUBE users with the AmazonPay Plugin or V2 Plugin installed, especially those with versions prior to v1.1.13 or v4.3.2.

• Potential redirects to arbitrary websites during ordering may expose user account information
• Defenders must verify EC-CUBE AmazonPay Plugin and V2 Plugin versions to ensure they are up-to-date
• Users with affected versions require monitoring for suspicious redirects during the ordering process

Technical summary

CVE-2026-103671 is an external control of assumed-immutable web parameter issue in the EC-CUBE AmazonPay Plugin. If exploited, it may redirect users to arbitrary websites during the ordering process, potentially exposing user account information. Affected versions include v1.1.7 or earlier, v1.0.0 or earlier, and v4.2.3 or earlier. Defenders should prioritize verifying exposure for EC-CUBE users with the AmazonPay Plugin or V2 Plugin installed, especially those with versions prior to v1.1.13 or v4.3.2, and assess potential redirect risks during the ordering process. The issue is particularly concerning for EC-CUBE users with outdated versions of the plugin.

Defensive priority

Defenders should prioritize verifying exposure for EC-CUBE users with the AmazonPay Plugin or V2 Plugin installed, especially those with versions prior to v1.1.13 or v4.3.2, and assess potential redirect risks during the ordering process.

Recommended defensive actions

• Verify EC-CUBE AmazonPay Plugin and V2 Plugin versions, ensuring they are v1.1.13 or later for 4.0/4.1 series or v4.3.2 or later for 4.2/4.3 series
• Assess potential exposure for users with affected versions, focusing on those with redirects to arbitrary websites during ordering
• Monitor for suspicious redirects during the ordering process, especially for user account information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the external control of assumed-immutable web parameter issue in the EC-CUBE AmazonPay Plugin, which may allow redirects to arbitrary websites during ordering, potentially exposing user account information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.