Live › vulnerability › CVE-2026-103306
Go to dashboardThe Online Payments with iK Pay Gateway WordPress plugin does not verify that its payment callback comes from the real gateway on a default installation. An unauthenticated attacker can send a forged payment notification to mark any order as paid without paying, or mark unprocessed orders as failed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Any WordPress site running the iK Pay Gateway plugin below version 3.0.4 with its default configuration is exposed, because the payment callback is reachable by anyone on the internet. Sites that have already updated, or that do not use this plugin, can skip it.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version if WP-CLI is available3.0.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
This page as .md · .json · in your agent: get_signal("CVE-2026-103306")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.