What is GHSA-xvqw-hjj4-j538?

GHSA-xvqw-hjj4-j538 is a security advisory published by GitHub Security Advisories with Medium severity. The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify...

Which CVE IDs does GHSA-xvqw-hjj4-j538 cover?

GHSA-xvqw-hjj4-j538 covers the following CVE IDs: CVE-2026-105970. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xvqw-hjj4-j538?

GHSA-xvqw-hjj4-j538 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-xvqw-hjj4-j538MediumCVSS 5.3

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-105970 →

📋 Description

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-105970
https://wpscan.com/vulnerability/7c3f164c-8659-401d-b746-542e705c9e86
https://github.com/advisories/GHSA-xvqw-hjj4-j538