{"affected":[{"defaultStatus":"unknown","product":"Thanh Toán Quét Mã QR Code Tự Động","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"2.0.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-105970","cwes":["CWE-284"],"description":"The Thanh Toán Quét Mã QR Code Tự Động  WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/7c3f164c-8659-401d-b746-542e705c9e86/"}],"kev":null,"metrics":[],"modifiedAt":1794117630312,"publishedAt":1794117630312,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/7c3f164c-8659-401d-b746-542e705c9e86/"}],"remediation":[],"revision":"fae1891052bf419d93a462dc48e24c37f830a8b41b0706b61500258e30842fe7","sources":[{"modifiedAt":1794117630312,"name":"CNA: WPScan","retrievedAt":1794118106906,"url":"https://www.cve.org/CVERecord?id=CVE-2026-105970"}],"ssvc":null,"status":"published","title":"BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation","updatedAt":1794118106906}