What is GHSA-4xm4-56qr-w7fc?

GHSA-4xm4-56qr-w7fc is a security advisory published by GitHub Security Advisories with Medium severity. The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify...

Which CVE IDs does GHSA-4xm4-56qr-w7fc cover?

GHSA-4xm4-56qr-w7fc covers the following CVE IDs: CVE-2026-103319. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4xm4-56qr-w7fc?

GHSA-4xm4-56qr-w7fc has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-4xm4-56qr-w7fcMediumCVSS 5.3

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify...

Vendor

GitHub Security Advisories

Published

October 26, 2026

Last Modified

October 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-103319 →

📋 Description

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-103319
https://wpscan.com/vulnerability/c07f15a0-3c15-429f-bcde-1511ad658c6c
https://github.com/advisories/GHSA-4xm4-56qr-w7fc