CVE-2026-103376: PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- Severity
- 0 (N/A)
- Vendor
- ADOBE
- Affected versions
- 1.117.9 through before 1.120.70
- Fixed version
- 1.120.70
- Patch status
- Patched
- Published
- 2026-10-17T06:16:30.930
- Modified
- 2026-10-17T06:16:30.930
Why it matters
This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.
Recommended admin actions
- Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
- Check whether the affected WordPress plugin or theme is installed.
- Update, disable, or remove the affected component if present.
- Compare installed versions against the affected version range in the advisory.
- Treat internet-facing systems as higher priority.
Technical summary
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
View the official NVD record for CVE-2026-103376
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
100 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-111823 |
mage-ai PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104736 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-111911 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110653 |
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-111853 |
3 Series MDO PATCH
Reporter: CVE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111884 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111901 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111908 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111923 |
fleet PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111924 |
fleet PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111927 |
coder PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111882 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111893 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-111880 |
FreeRDP PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-111854 |
3 Series MDO PATCH
Reporter: CVE
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-92798 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-111898 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-111895 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-111855 |
3 Series MDO PATCH
Reporter: CVE
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-107762 |
Kirki – Freeform Page Builder, Website Builder & Customizer
Reporter: SECURITY
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-108123 |
WP Booking System – Booking Calendar
Reporter: SECURITY
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-110889 |
Gantry 5 Framework
Reporter: AUDIT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-104734 |
Kirki – Freeform Page Builder, Website Builder & Customizer
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-109208 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-103899 |
EU VAT Assistant for WooCommerce
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-96660 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-100316 |
European VAT Compliance Assistant for WooCommerce
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111110 |
Payment forms, Buy now buttons, and Invoicing System | GetPaid
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111881 |
FreeRDP PATCH
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111909 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111922 |
vikunja PATCH
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-110384 |
Fancy Comments WordPress
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-109701 |
PAYCOMET for WooCommerce
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111886 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111897 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111906 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111907 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111910 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111912 |
admidio PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111914 |
admidio PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111917 |
vikunja PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111919 |
Vikunja 0.22.0 PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111885 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-111890 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-111891 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-111905 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-111887 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111892 |
phpMyFAQ 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111902 |
phpMyFAQ 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111904 |
phpMyFAQ 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111916 |
Admidio PATCH
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-109369 |
WP Booking System – Booking Calendar
Reporter: SECURITY
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-107744 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-109368 |
WP Booking System – Booking Calendar
Reporter: SECURITY
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-109985 |
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN
Reporter: SECURITY
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-109989 |
Themify Popup
Reporter: SECURITY
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-111726 |
Themify Builder
Reporter: SECURITY
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-109983 |
YMC Filter
Reporter: SECURITY
|
6.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-111933 |
coder PATCH
Reporter: DISCLOSURE
|
6.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111934 |
Coder PATCH
Reporter: DISCLOSURE
|
6.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111601 |
Hippoo Mobile App for WooCommerce
Reporter: SECURITY
|
6.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-111929 |
coder PATCH
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-110253 |
weForms – Easy Drag & Drop Contact Form Builder For WordPress
Reporter: SECURITY
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2024-58398 |
Coder 2.3.1 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111889 |
phpMyFAQ from 4.1.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111900 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111913 |
Admidio from 5.0.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111918 |
Vikunja from 1.0.0-rc0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111920 |
vikunja
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111921 |
Vikunja 0.13.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111928 |
Coder from 2.0.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111930 |
Coder from 2.26.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111931 |
Coder from 2.0.0 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111888 |
phpMyFAQ from 4.0.0 PATCH
Reporter: DISCLOSURE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-111894 |
phpMyFAQ 3.2.1 PATCH
Reporter: DISCLOSURE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-111896 |
phpMyFAQ from 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-111903 |
phpMyFAQ 4.2.0-alpha PATCH
Reporter: DISCLOSURE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-107752 |
Welcart e-Commerce
Reporter: SECURITY
|
4.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-110268 |
Post Export Import with Media
Reporter: SECURITY
|
4.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-111926 |
Coder from 2.10.0 PATCH
Reporter: DISCLOSURE
|
4.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-111932 |
coder PATCH
Reporter: DISCLOSURE
|
4.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-107763 |
Fastcache by Host.it
Reporter: SECURITY
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-92715 |
Tutor LMS – eLearning and online course solution PATCH
Reporter: SECURITY
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-92978 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-110882 |
SMS Alert Order Notifications PATCH
Reporter: AUDIT
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111602 |
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Reporter: SECURITY
|
3.7
LOW
|
VIEW RECORD |
| CVE-2025-71435 |
Coder PATCH
Reporter: DISCLOSURE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-111865 |
yoloe
Reporter: CNA
|
1.9
LOW
|
VIEW RECORD |
| CVE-2026-103376 |
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-104122 |
Ukr-To-Lat
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-104246 |
Contact Form 7 Signature Addon
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-106470 |
WP Data Access PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-110527 |
WP User Manager PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-81343 |
ACF Frontend Admin by DynamiApps
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-81344 |
ACF Frontend Admin by DynamiApps
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-91074 |
BSK PDF Manager
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-92431 |
Patreon WordPress PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-92432 |
Patreon WordPress PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-92433 |
Patreon WordPress PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
| CVE-2026-97314 |
ThirstyAffiliates PATCH
Reporter: CONTACT
|
0
N/A
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.