CVE-2026-103517 Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook
Attackers can forge payment webhooks to mark orders as paid without actual payment if the webhook secret is not configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103517?
CVE-2026-103517 is a medium-severity authentication bypass vulnerability in Unknown Airwallex Online Payments Gateway, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
Weakness: CWE-345
Which versions are affected by CVE-2026-103517?
How do I fix CVE-2026-103517?
No fix has been published for CVE-2026-103517 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-103517 being exploited?
There is no known exploitation of CVE-2026-103517 in the wild and no public exploit code.
Sources
Also known as GHSA-wvf8-rf78-rqr9.