CVE-2026-103301 Payment Gateway for Telcell CVE debrief

Who should care

Defenders responsible for WordPress installations with the Payment Gateway for Telcell plugin should assess exposure and prioritize updating the plugin to version 2.0.5 or later. This includes operators, administrators, and security teams who manage WordPress installations with the plugin installed. Additionally, defenders who manage WooCommerce orders and payment notifications should also be aware of this vulnerability and take steps to verify the

Why it matters

The vulnerability allows unauthenticated attackers to forge valid payment notifications, potentially leading to financial losses and reputational damage.

• Unauthenticated attackers can forge valid payment notifications
• Arbitrary WooCommerce orders can be marked as paid
• Defenders must verify the authenticity of payment notifications
• Plugin update to version 2.0.5 or later is necessary

Technical summary

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The plugin's failure to verify the authenticity of payment notifications could result in financial losses and reputational damage if exploited. Defenders should prioritize verifying the authenticity of payment notifications and updating the plugin to version 2.0.5 or later.

Defensive priority

Defenders should prioritize verifying the authenticity of payment notifications and updating the plugin to version 2.0.5 or later.

Recommended defensive actions

• Verify the authenticity of payment notifications
• Update the plugin to version 2.0.5 or later
• Monitor for suspicious payment activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from the vendor and other sources may be necessary to fully understand the impact. The vulnerability is caused by the plugin's failure to verify the authenticity of incoming payment notifications, which allows unauthenticated attackers to forge valid notifications. The vendor's documentation and support resources may provide further guidance on mitigating this vulnerability. Defenders should verify the authenticity of payment notifications,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.