Mintpay for WooCommerce

Mintpay for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Mintpay for WooCommerce has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.

All of these findings were reported by Naoki Kawahigashi. Mintpay for WooCommerce is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Mintpay for WooCommerce vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-103381

Mintpay <= 2.2.3 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Mintpay for WooCommerce banner
Latestv3.0.0

Mintpay for WooCommerce

mintpay

Author

mintpay

3.0(2)
60/100
Last Updated
2026-10-20 (8d ago)
Active Installs
600+
Downloads
10,808
Requires WP
7.0+
Requires PHP
8.3+
Tested up to
WP 7.1.3
Created
2022-04-11 (5y ago)
Requires Plugins
woocommerce

Mintpay lets your customers pay now for instant cashback (Mint Coins) or split their purchase into 3 interest-free installments. The plugin adds Mintpay as a payment method on both classic and block-based checkouts, and shows installment / cashback messaging on product pages. Features: Works on classic and block-based WooCommerce checkout. Product-page installment and cashback breakdown. First-purchase promo (MINT20) on the checkout — including block checkout. High-Performance Order Storage (HPOS) compatible. “Refund via Mintpay” link to the Mintpay merchant portal. External Services This plugin connects to the Mintpay API to create purchases, verify payment results server-to-server, and fetch the merchant’s cashback configuration. The connection is required for the gateway to function. The service is operated by Mintpay (Private) Limited. API endpoints: app.mintpay.lk (live) and stage.mintpay.lk (sandbox) handle order creation, payment-status verification, and cashback configuration. The hosted checkout page the shopper is redirected to is served from the *-gateway.mintpay.lk host returned by the API. static.mintpay.lk serves promo imagery; merchant.mintpay.lk / stage-merchant.mintpay.lk is the merchant refund-portal link. Data sent when a purchase is created: the store merchant ID, the WooCommerce order ID, the order total, the sales channel, the customer’s email, phone and IP address (as recorded by WooCommerce; the browser-supplied X-Forwarded-For header is only forwarded instead when the merchant opts in via the mintpay_trust_forwarded_for filter), the billing address (street, city/region, postcode), cart created/updated timestamps, the success and fail return URLs, and for each line item its name, product ID, SKU, quantity, unit price and product timestamps. Data sent when verifying a payment: the store merchant ID and the Mintpay purchase ID. Data sent when fetching cashback configuration: the store’s Mintpay merchant ID and API token (the token is sent in the Authorization header and is never logged). Terms & Conditions: https://app.mintpay.lk/terms/ Privacy Policy: https://app.mintpay.lk/privacy/ Copyright Mintpay for WooCommerce is Copyright (C) 2026 Mintpay (Private) Limited, licensed under GPL-3.0-or-later. “Mintpay” and the Mintpay logo are trademarks of Mintpay (Private) Limited and are not licensed for use in derivative, competing, or rebranded products. Removing copyright notices, relicensing, or redistributing without source violates the GPL and applicable copyright and trademark law.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C