Unrated severityNVD Advisory· Published Nov 12, 2026
CVE-2026-106027
CVE-2026-106027
Description
The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.0.9
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.