---
id: "CVE-2026-103306"
kind: "vulnerability"
aliases: ["CVE-2026-103306"]
title: "WordPress iK Pay Gateway plugin accepts forged payment callbacks, marking orders paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-updated-3.0.4"]
published_at: "2026-10-26T07:17:07+00:00"
first_seen_at: "2026-10-26T07:28:49+00:00"
updated_at: "2026-10-26T07:30:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103306", "first_seen_at": "2026-10-26T07:28:49+00:00"}]
---

# WordPress iK Pay Gateway plugin accepts forged payment callbacks, marking orders paid

The Online Payments with iK Pay Gateway WordPress plugin does not verify that its payment callback comes from the real gateway on a default installation. An unauthenticated attacker can send a forged payment notification to mark any order as paid without paying, or mark unprocessed orders as failed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available
- Confirm whether the iK Pay Gateway plugin is active on the site
- unknown for any further check, as the sources do not describe a specific endpoint or log signature

## Fix

- Update the Online Payments with iK Pay Gateway plugin to `3.0.4` or later
- unknown for any interim mitigation, as the sources do not say

## Timeline

- 2026-10-26T07:28:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103306

## From the sources

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_