VulnSocial

CVE-2026-33661Disclosure(yansongda / pay)

LOWCVSS 7.5 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch yansongda pay systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.

yansongda CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-290

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pay

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
yansongda
Products
pay

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-26: 3Patch / Workaround · 2026-03-26: 2Technical Details · 2026-03-26: 303-26
Signal classification3 categories
Disclosure
133.3%
General
133.3%
Patch
133.3%
Referenced assets3 URLs
Full discourse3 posts
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-33661 - High Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally s... https://www.thehackerwire.com/vulnerability/CVE-2026-33661/ https://t.co/eiTp5K1Bb5

    Post summary

    CVE-2026-33661 is a high‑severity flaw in the Pay SDK’s verify_wechat_sign() function, fixed in version 3.7.20. No PoC, exploit code, or active exploitation details are provided.

    0000047
    163 followersView on X
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-33661: HIGH] Pay SDK prior to v3.7.20 has a severe security vulnerability that could allow attackers to forge fake payment notifications on WeChat Pay. Make sure to update to v3.7.20 to fix this is...#cve,CVE-2026-33661,#cybersecurity https://cvefind.com/CVE-2026-33661

    Post summary

    CVE-2026-33661 is a severe vulnerability in Pay SDK versions prior to 3.7.20 that lets attackers forge fake WeChat Pay notifications; updating to v3.7.20 resolves the issue.

    0000040
    617 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-33661 Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functio… https://www.cve.org/CVERecord?id=CVE-2026-33661

    Post summary

    CVE-2026-33661 concerns a flaw in Pay’s verify_wechat_sign() before v3.7.20, but no PoC, exploit, exploitation evidence, or patch details are mentioned.

    0000072
    56.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appyansongdapay---

Explore more

Back to dashboardyansongda CVEspay vulnerabilities