{"id":"CVE-2026-103302","kind":"vulnerability","aliases":["CVE-2026-103302"],"related":[],"title":"WordPress Idram payment plugin accepts forged payment confirmations, marking orders paid","description":"The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.","summary":"The Payment Gateway for Idram WordPress plugin does not verify incoming payment notifications because its merchant credentials used for the checksum are empty by default. An unauthenticated attacker can forge a payment confirmation to mark any order as paid, or force orders into a failed state.","severity":"medium","cvss":5.3,"epss":0.00231,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["no-idram-gateway","plugin-version-2.1.6-or-later"],"how_to_check":"- Check the installed version of the Payment Gateway for Idram plugin in the WordPress admin under Plugins; it is affected below `2.1.6`.\n- Check whether the Idram merchant credentials (secret key) are empty in the plugin's gateway settings.","fix":"- Update the Payment Gateway for Idram plugin to `2.1.6` or later.\n- Set non-empty Idram merchant credentials in the plugin settings.","status":"open","published_at":"2026-10-21T06:16:45+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:22:20+00:00","updated_at":"2026-10-25T04:22:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:22:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Payment Gateway for Idram plugin to `2.1.6` or later.\n- Set non-empty Idram merchant credentials in the plugin settings.","reach":"internet","title":"WordPress Idram payment plugin accepts forged payment confirmations, marking orders paid","impact":"medium","summary":"The Payment Gateway for Idram WordPress plugin does not verify incoming payment notifications because its merchant credentials used for the checksum are empty by default. An unauthenticated attacker can forge a payment confirmation to mark any order as paid, or force orders into a failed state.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker marks arbitrary orders paid without paying","analyst_note":"","how_to_check":"- Check the installed version of the Payment Gateway for Idram plugin in the WordPress admin under Plugins; it is affected below `2.1.6`.\n- Check whether the Idram merchant credentials (secret key) are empty in the plugin's gateway settings.","needs_analyst":false,"not_affected_if":["plugin-version-2.1.6-or-later","no-idram-gateway"],"who_is_affected":"Sites running the Payment Gateway for Idram WordPress plugin before 2.1.6 that accept Idram payments through it are exposed, especially where the merchant credentials were left empty. Stores that do not use this plugin or that run a newer version can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3397,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103302':14A,17A '-2026':13A,16A '2.1.6':76C 'accept':5A 'allow':99C 'arbitrari':110C,117C 'attack':49B,101C 'authent':81C 'checksum':42B,94C 'comput':92C 'configur':128C 'confirm':8A,54B,107C 'credenti':38B,89C 'cve':12A,15A 'default':46B,98C 'ecommerc':18B 'empti':44B,96C 'fail':66B,121C 'forc':62B,116C 'forg':6A,51B,103C 'gateway':24B,70C,126C 'idram':2A,26B,72C 'incom':32B,83C 'mark':9A,56B,109C 'merchant':37B,88C 'notif':34B,85C 'order':10A,58B,63B,111C,118C 'packag':19B 'paid':11A,60B,113C 'payment':3A,7A,23B,33B,53B,69C,84C,106C 'plugin':4A,28B,74C 'regardless':123C 'state':67B,122C 'unauthent':48B,100C 'use':39B,90C 'valid':105C 'verifi':31B,79C 'woocommerc':20B 'wordpress':1A,21B,27B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Payment Gateway for Idram WordPress plugin before 2.1.6 that accept Idram payments through it are exposed, especially where the merchant credentials were left empty. Stores that do not use this plugin or that run a newer version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103302","severity":null,"published_at":"2026-10-21T06:16:45+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-103302","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103302","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}