What is GHSA-wvf8-rf78-rqr9?

GHSA-wvf8-rf78-rqr9 is a security advisory published by GitHub Security Advisories with Medium severity. The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an...

Which CVE IDs does GHSA-wvf8-rf78-rqr9 cover?

GHSA-wvf8-rf78-rqr9 covers the following CVE IDs: CVE-2026-103517. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wvf8-rf78-rqr9?

GHSA-wvf8-rf78-rqr9 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-wvf8-rf78-rqr9MediumCVSS 5.3

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an...

Vendor

GitHub Security Advisories

Published

October 8, 2026

Last Modified

October 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-103517 →

📋 Description

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-103517
https://wpscan.com/vulnerability/17179c6d-32e0-4a22-88b4-9768a5f36365
https://github.com/advisories/GHSA-wvf8-rf78-rqr9