In the EC-CUBE admin, open the plugin list and note the Amazon Pay plugin version. Anything at or below v1.1.12 (V2 for 4.0/4.1), v4.3.1 (V2 for 4.2/4.3, bundled edition included) or v1.3.0 (CV1) is affected by CVE-2026-103671, which the developer says is being exploited. Update to the latest plugin; on CV1 v1.2.9 or older, plan the move to the CV2 plugin, since a direct upgrade isn't possible. Then search web server logs since early October for Amazon Pay checkout requests whose parameters point to domains other than your shop or Amazon, and check whether customers have complained about unexpected login pages during checkout. If you find signs of abuse, tell affected customers to change their passwords.