Vulnerability in Payment Integration Wompi

CVE-2026-103312

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.

Published · last modified .

EPSS exploit prediction

EPSS: 0.002 (6.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 6.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

  • Payment Integration Wompi

References