Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-w8h7-441p-6ygz
Vulnerability ID VCID-w8h7-441p-6ygz
Aliases CVE-2026-33661
GHSA-q938-ghwv-8gvc
Summary Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-290 Authentication Bypass by Spoofing
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00016 https://api.first.org/data/v1/epss?cve=CVE-2026-33661
epss 0.00016 https://api.first.org/data/v1/epss?cve=CVE-2026-33661
epss 0.00016 https://api.first.org/data/v1/epss?cve=CVE-2026-33661
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-q938-ghwv-8gvc
cvssv3.1 8.6 https://github.com/yansongda/pay
generic_textual HIGH https://github.com/yansongda/pay
cvssv3.1 8.6 https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f
generic_textual HIGH https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f
ssvc Track https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f
cvssv3.1 8.6 https://github.com/yansongda/pay/releases/tag/v3.7.20
generic_textual HIGH https://github.com/yansongda/pay/releases/tag/v3.7.20
ssvc Track https://github.com/yansongda/pay/releases/tag/v3.7.20
cvssv3.1 8.6 https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc
cvssv3.1_qr HIGH https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc
generic_textual HIGH https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc
ssvc Track https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc
cvssv3.1 8.6 https://nvd.nist.gov/vuln/detail/CVE-2026-33661
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-33661
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-33661
https://github.com/yansongda/pay
https://nvd.nist.gov/vuln/detail/CVE-2026-33661
26987ebf789f1e7f0a85febb640986ab4289fd7f https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f
GHSA-q938-ghwv-8gvc https://github.com/advisories/GHSA-q938-ghwv-8gvc
GHSA-q938-ghwv-8gvc https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc
v3.7.20 https://github.com/yansongda/pay/releases/tag/v3.7.20
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/yansongda/pay
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-27T14:12:47Z/ Found at https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/yansongda/pay/releases/tag/v3.7.20
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-27T14:12:47Z/ Found at https://github.com/yansongda/pay/releases/tag/v3.7.20
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-27T14:12:47Z/ Found at https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-33661
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.03721
EPSS Score 0.00016
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:49:38.667956+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/33xxx/CVE-2026-33661.json 38.6.0