Not rated
CVE-2026-105970 BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation
Description
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Thanh Toán Quét Mã QR Code Tự Động 2.0 | earliest → 2.0.1 | No fix stated |