CVE-2026-103381 Mintpay CVE debrief

Who should care

Defenders responsible for the security of WooCommerce sites using the Mintpay plugin, especially those with versions up to 2.2.3, should assess their exposure and consider verifying the authenticity of payment callbacks and updating to a patched version if available.

Why it matters

The Mintpay for WooCommerce plugin vulnerability allows unauthenticated attackers to manipulate order payments and disclose sensitive information, requiring defenders to verify payment callback authenticity and consider updates to prevent exploitation.

• Unauthenticated attackers can mark arbitrary orders as paid
• Unauthenticated attackers can cancel arbitrary orders
• Unauthenticated attackers can disclose order details including customer contact information
• Defenders need to verify the authenticity of payment callbacks in the Mintpay for WooCommerce plugin

Technical summary

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information. The plugin's failure to validate callback authenticity enables attackers to manipulate order payments and disclose sensitive information. Defenders should prioritize verifying the authenticity of payment callbacks in the Mintpay for WooCommerce plugin, especially for versions up to 2.2.3, and consider updating to a patched version if available. The vulnerability requires defenders to assess their exposure and take steps

Defensive priority

Defenders should prioritize verifying the authenticity of payment callbacks in the Mintpay for WooCommerce plugin, especially for versions up to 2.2.3, and consider updating to a patched version if available.

Recommended defensive actions

• Verify the authenticity of payment callbacks in the Mintpay for WooCommerce plugin
• Consider updating to a patched version if available
• Monitor order payment completion and cancellation for suspicious activity
• Review and update incident response plans to address potential exploitation
• Perform vulnerability scanning to identify exposed systems
• Implement additional logging and monitoring for payment callback activity
• Review and update asset inventory to ensure accurate tracking of affected systems

Evidence notes

The CVE record and source item provide details on the vulnerability in the Mintpay for WooCommerce plugin, including its impact on order payment completion and cancellation, and customer contact information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.