Cardinity CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Cardinity CVE published 2026-10-15

CVE-2026-103324

The Cardinity Payment Gateway for WooCommerce plugin for WordPress contains a vulnerability that allows unauthenticated attackers to forge approved-payment notifications, potentially marking arbitrary orders as paid or forcing them to fail. This issue arises from the plugin's default use of an empty secret for signing payment notifications, which prevents proper verification of their authenticity.