Published:2026/10/14  Last Updated:2026/10/14

JVN#43511918
EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter
Critical

Overview

EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter

Products Affected

  • CV2 version
    • AmazonPay V2 Plugin (4.0/4.1 series) v1.1.7 to v1.1.12
    • AmazonPay V2 Plugin (4.0/4.1 series) v1.0.0 to v1.1.6
    • AmazonPay V2 Plugin (4.2/4.3 series) v4.3.1 (Bundle Edition)
    • AmazonPay V2 Plugin (4.2/4.3 series) v4.2.3 to v4.3.1
    • AmazonPay V2 Plugin (4.2/4.3 series) v4.2.0 to v4.2.2
  • CV1 version
    • AmazonPay Plugin v1.3.0 and earlier (4.0 series)

Description

EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin provided by EC-CUBE CO.,LTD. contains the following vulnerability.

  • External Control of Assumed-Immutable Web Parameter (CWE-472)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N Base Score 5.3
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N Base Score 4.7
    • CVE-2026-103671
The developer states that attacks exploiting the vulnerability has been observed.

Impact

The user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
EC-CUBE CO.,LTD. Vulnerable 2026/10/14 EC-CUBE CO.,LTD. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-103671
JVN iPedia JVNDB-2026-000150