CVE-2026-103671

LOWCVSS 5.3 · MEDIUM

Signal is active with 4 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-472

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

4 mentions across 1 observed day

What's happening

4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse4 posts

Autumn Good@autumn_good_351d
🚨🚨🚨 『開発者によると、本脆弱性を悪用した攻撃が既に確認されています。』 CVE-2026-103671 JVN#43511918: EC-CUBE4系用プラグイン「AmazonPayプラグイン」における不変と想定しているWebパラメータの外部制御の脆弱性 https://jvn.jp/jp/JVN43511918/
19121144.0K
7.3K followersView on X
Daily CyberSecurity@Daily_CyberSec1d
Attackers are exploiting CVE-2026-103671 in the wild, an EC-CUBE AmazonPay Plugin vulnerability that redirects shoppers to steal account credentials. #CVE2026103671 #ECCUBE #AmazonPay #EcommerceSecurity #JPCERT #Cybersecurity #InfoSec https://securityonline.info/ec-cube-amazonpay-plugin-cve-2026-103671-exploited/
00020396
13.0K followersView on X
Harmonic Society株式会社｜千葉のホームページ制作@hs2303031d
EC-CUBE 4の公式「AmazonPayプラグイン」に脆弱性（CVE-2026-103671）。すでに悪用も確認されてるらしい。ネットショップでこのプラグインを使ってるところは要確認。CV1対応版の古い版は、CV2対応版への移行が推奨とのこと
1000037
18 followersView on X
moton@moton1d
EC-CUBE AmazonPay Plugin CVE-2026-103671 Exploited in Wild - https://securityonline.info/ec-cube-amazonpay-plugin-cve-2026-103671-exploited/
0000061
758 followersView on X

Explore more

Back to dashboard