CVE-2026-103517 — Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook

CVE-2026-103517

Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook PUBLISHED

Description (CNA)

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.

Affected (CNA)

Vendor / product	Versions
Unknown / Airwallex Online Payments Gateway	affected 0 before 1.36.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/17179c6d-32e0-4a22-88b4-9768a5f36365/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.