CVE-2026-103376 PeachPay CVE debrief

Who should care

Defenders responsible for WooCommerce installations using the affected PeachPay plugin version should assess exposure and prioritize verification and remediation efforts. This includes reviewing the current plugin version, restricting access to order information, and monitoring for potential unauthorized access to order data. Security teams and vulnerability management teams should also prioritize verifying exposure and implementing mitigations.

Why it matters

The CVE-2026-103376 vulnerability in the PeachPay WordPress plugin allows unauthenticated retrieval of order secret keys, potentially leading to unauthorized access to sensitive customer information. Defenders should prioritize verifying exposure and restricting access to order information.

• Potential unauthorized access to order data
• Possible view of customer sensitive information
• Required verification of WooCommerce installations for exposure
• Potential impact on customer data confidentiality

Technical summary

The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents. This vulnerability allows unauthenticated retrieval of sensitive information, potentially leading to unauthorized access.

Defensive priority

Defenders should prioritize verifying exposure of WooCommerce installations using the affected PeachPay plugin version and restrict access to order information.

Recommended defensive actions

• Verify WooCommerce installations for use of the affected PeachPay plugin version
• Restrict access to order information
• Monitor for potential unauthorized access to order data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is required to determine the full scope of affected systems and potential impact. The PeachPay plugin before version 1.120.70 does not perform capability checks for secret key retrieval. Defenders should verify exposure and restrict access to order information. Evidence is limited, and verification tasks are needed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.