CVE-2026-103671

CVSS 5.3 (medium) · published 2026-10-14

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.

Weakness: CWE-472

Source: NVD CVE-2026-103671

References

• https://jvn.jp/en/jp/JVN43511918/
• https://www.ec-cube.net/news/detail.php?news_id=490

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.