{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106027", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-06T13:14:08.045Z", "datePublished": "2026-11-12T06:00:06.145Z", "dateUpdated": "2026-11-12T06:00:06.145Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-12T06:00:06.145Z"}, "title": "Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Oxygen MyData for WooCommerce", "versions": [{"status": "affected", "versionType": "semver", "version": "3.0.0", "lessThan": "3.0.9"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed."}], "references": [{"url": "https://wpscan.com/vulnerability/6f364114-e016-4c60-9ced-5b726d84bc19/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Naoki Kawahigashi", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Oxygen MyData for WooCommerce", "vendor": "Unknown", "versions": [{"lessThan": "3.0.9", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed."}], "id": "CVE-2026-106027", "lastModified": "2026-11-12T06:17:10.350", "metrics": {}, "published": "2026-11-12T06:17:10.350", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/6f364114-e016-4c60-9ced-5b726d84bc19/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{}