Vulnerability · Published Oct 28, 2026 · Assigned by WPScan
CVE-2026-103372Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure
Medium 5.3
In plain English
A medium-severity information exposure in Payconiq from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 81.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/19956956-b66f-47e6-9038-29d38283589a/ exploit, vdb-entry, technical-description