WordPress Plugin Vulnerabilities

Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback

Description

The plugin does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.

Proof of Concept

Affects Plugins

Plugin icon
oxygen-mydata
Fixed in 3.0.9

References

CVE
CVE-2026-106027

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
6f364114-e016-4c60-9ced-5b726d84bc19

Timeline

Publicly Published
2026-11-10 (about 2 days ago)
Added
2026-11-10 (about 1 day ago)
Last Updated
2026-11-10 (about 1 day ago)

Other

Published
Title
Published
2025-06-06
Title
Audio Editor & Recorder < 2.2.2 - Missing Authorization
Published
2024-07-10
Title
Payflex Payment Gateway < 2.6.0 - Missing Authorization to Order Status Update
Published
2026-07-10
Title
Wallet for WooCommerce < 1.6.5 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action
Published
2026-08-24
Title
Fluent Support Pro < 2.3.2 - Missing Authorization
Published
2026-04-28
Title
Booking for Appointments and Events Calendar – Amelia < 2.2.1 - Missing Authorization