JPCERT/CC and IPA published JVN#43511918 on Oct 14 for CVE-2026-103671 in EC-CUBE's official AmazonPay plugin for EC-CUBE 4, a widely used Japanese open-source shop platform. The flaw lets an attacker control a checkout parameter the plugin assumes can't change (CWE-472), so a shopper can be sent to an arbitrary site during the order flow and have account information stolen. JVN says the developer has observed attacks exploiting it. Affected: AmazonPay V2 plugin for EC-CUBE 4.0/4.1 up to v1.1.12, V2 plugin for 4.2/4.3 v4.2.0 through v4.3.1 (including the bundled edition), and the CV1 AmazonPay plugin v1.3.0 and earlier. The scores are moderate (CVSS v4 5.3, v3 4.7, user interaction required), but EC-CUBE's own notice rates the urgency high and says to update to the latest plugin. CV1 sites on v1.2.9 or earlier can't upgrade directly to v1.3.1 and should migrate to the CV2 plugin. The hosted ec-cube.co service is already fixed. It is not in CISA KEV.