{"id":"CVE-2026-103306","kind":"vulnerability","aliases":["CVE-2026-103306"],"related":[],"title":"WordPress iK Pay Gateway plugin accepts forged payment callbacks, marking orders paid","description":"The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.","summary":"The Online Payments with iK Pay Gateway WordPress plugin does not verify that its payment callback comes from the real gateway on a default installation. An unauthenticated attacker can send a forged payment notification to mark any order as paid without paying, or mark unprocessed orders as failed.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","package","payments","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated-3.0.4"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available\n- Confirm whether the iK Pay Gateway plugin is active on the site\n- unknown for any further check, as the sources do not describe a specific endpoint or log signature","fix":"- Update the Online Payments with iK Pay Gateway plugin to `3.0.4` or later\n- unknown for any interim mitigation, as the sources do not say","status":"open","published_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:30:05+00:00","updated_at":"2026-10-26T07:30:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T07:30:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Online Payments with iK Pay Gateway plugin to `3.0.4` or later\n- unknown for any interim mitigation, as the sources do not say","reach":"internet","title":"WordPress iK Pay Gateway plugin accepts forged payment callbacks, marking orders paid","impact":"high","summary":"The Online Payments with iK Pay Gateway WordPress plugin does not verify that its payment callback comes from the real gateway on a default installation. An unauthenticated attacker can send a forged payment notification to mark any order as paid without paying, or mark unprocessed orders as failed.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payments","e-commerce"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker marks arbitrary orders paid without payment being made","analyst_note":"Check the plugin's changelog or the NVD entry for the affected callback endpoint and any log signature, to fill in how_to_check.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available\n- Confirm whether the iK Pay Gateway plugin is active on the site\n- unknown for any further check, as the sources do not describe a specific endpoint or log signature","needs_analyst":true,"not_affected_if":["plugin-updated-3.0.4","plugin-not-installed"],"who_is_affected":"Any WordPress site running the iK Pay Gateway plugin below version 3.0.4 with its default configuration is exposed, because the payment callback is reachable by anyone on the internet. Sites that have already updated, or that do not use this plugin, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3335,"output_tokens":635,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103306':15A,18A '-2026':14A,17A '3.0.4':84C 'accept':6A 'allow':100C 'arbitrari':111C,123C 'attack':53B,102C 'authent':90C 'callback':9A,41B,95C 'come':42B 'commerc':21B 'cve':13A,16A 'default':49B,98C 'e':20B 'e-commerc':19B 'fail':73B,127C 'forg':7A,57B,104C 'gateway':4A,32B,46B,80C,94C 'ik':2A,30B,78C 'instal':50B,99C 'made':119C 'mark':10A,61B,69B,110C,122C 'notif':59B,108C 'onlin':27B,75C 'order':11A,63B,71B,112C,125C 'packag':22B 'paid':12A,65B,114C 'pay':3A,31B,67B,79C 'payment':8A,23B,28B,40B,58B,76C,93C,107C,117C 'plugin':5A,34B,82C 'proper':87C 'real':45B 'send':55B 'success':106C 'unauthent':52B,101C 'unprocess':70B,124C 'verifi':37B,88C 'without':66B,115C 'woocommerc':24B 'wordpress':1A,25B,33B,81C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the iK Pay Gateway plugin below version 3.0.4 with its default configuration is exposed, because the payment callback is reachable by anyone on the internet. Sites that have already updated, or that do not use this plugin, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103306","severity":null,"published_at":"2026-10-26T07:17:07+00:00","modified_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}