What is GHSA-3xwg-74wr-vh24?

GHSA-3xwg-74wr-vh24 is a security advisory published by GitHub Security Advisories with Medium severity. The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper...

Which CVE IDs does GHSA-3xwg-74wr-vh24 cover?

GHSA-3xwg-74wr-vh24 covers the following CVE IDs: CVE-2026-106027. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3xwg-74wr-vh24?

GHSA-3xwg-74wr-vh24 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-3xwg-74wr-vh24MediumCVSS 5.3

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper...

Vendor

GitHub Security Advisories

Published

November 12, 2026

Last Modified

November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-106027 →

📋 Description

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-106027
https://wpscan.com/vulnerability/6f364114-e016-4c60-9ced-5b726d84bc19
https://github.com/advisories/GHSA-3xwg-74wr-vh24