# CVE-2026-103299: nexi Alpha Bank for WooCommerce payment authentication bypass

Source: https://junglewise.ai/threats/cve-2026-103299-the-payment-gateway-wordpress-plugin-through-2-2-0-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-103299 · Severity: info · Published 2026-10-26

The nexi Alpha Bank for WooCommerce plugin through version 2.2.0 fails to validate a required security credential (shared secret) before processing payment notifications from the bank. This allows attackers to forge payment confirmations and mark any customer order as paid, or move pending orders to failed status, leading to unauthorized transactions and financial losses.

Vendors: [Nexi](https://junglewise.ai/threats/vendors/nexi).

## Quick answers

**Is CVE-2026-103299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103299 being exploited in the wild.

**How severe is CVE-2026-103299?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** Nexi Alpha Bank for WooCommerce through 2.2.0.

**Is there a fix for CVE-2026-103299?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103299 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103299?** Check whether you run Nexi Alpha Bank for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin does not validate whether a shared secret is configured before using it to authenticate payment callbacks from the bank, allowing unauthenticated attackers to forge valid payment notifications. An attacker can POST to the callback endpoint with an empty or no shared secret to mark arbitrary WooCommerce orders as paid, and can also move pending orders to failed state regardless of configuration. No authentication or user interaction is required; the vulnerability affects any install where the shared secret is not set.

## Affected products

- nexi Alpha Bank for WooCommerce through 2.2.0

## Timeline

- 2026-10-23: advisory
- 2026-10-26: disclosed

## References

- [https://wpscan.com/vulnerability/0a1c3070-181d-49ea-9488-d0d7e4be419c/](https://wpscan.com/vulnerability/0a1c3070-181d-49ea-9488-d0d7e4be419c/)