---
id: "CVE-2026-103302"
kind: "vulnerability"
aliases: ["CVE-2026-103302"]
title: "WordPress Idram payment plugin accepts forged payment confirmations, marking orders paid"
severity: "medium"
cvss: 5.3
epss: 0.00231
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "woocommerce", "wordpress"]
not_affected_if: ["no-idram-gateway", "plugin-version-2.1.6-or-later"]
published_at: "2026-10-21T06:16:45+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:22:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103302", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-103302", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# WordPress Idram payment plugin accepts forged payment confirmations, marking orders paid

The Payment Gateway for Idram WordPress plugin does not verify incoming payment notifications because its merchant credentials used for the checksum are empty by default. An unauthenticated attacker can forge a payment confirmation to mark any order as paid, or force orders into a failed state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Payment Gateway for Idram plugin in the WordPress admin under Plugins; it is affected below `2.1.6`.
- Check whether the Idram merchant credentials (secret key) are empty in the plugin's gateway settings.

## Fix

- Update the Payment Gateway for Idram plugin to `2.1.6` or later.
- Set non-empty Idram merchant credentials in the plugin settings.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103302
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-103302

## From the sources

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_