CVE-2026-103671
AmazonPay V2 Plugin (4.0/4.1 series)90/100
confirmed exploited
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
Listed in VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.002 (probability of exploitation) · CVSS base 5.3
Public PoC / Exploit
No public PoC/exploit references indexed yet. Newly-disclosed CVEs often have none — exploit publication lags disclosure.
References2
Mentions 1