Visma CVE debriefs

CVE-2026-103308

The Visma Pay for WooCommerce plugin before version 1.2.2 has a vulnerability that allows unauthenticated attackers to mark arbitrary orders as paid and disclose customer order data, including name, email, and postal address. This vulnerability is due to the plugin's failure to verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not e [truncated]