Live › vulnerability › CVE-2026-103302
Go to dashboardThe Payment Gateway for Idram WordPress plugin does not verify incoming payment notifications because its merchant credentials used for the checksum are empty by default. An unauthenticated attacker can forge a payment confirmation to mark any order as paid, or force orders into a failed state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Payment Gateway for Idram WordPress plugin before 2.1.6 that accept Idram payments through it are exposed, especially where the merchant credentials were left empty. Stores that do not use this plugin or that run a newer version can skip it.
No product ranges from the sources yet.
2.1.6.2.1.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-103302")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.