Live › vulnerability › CVE-2026-103330
Go to dashboardThe Sadad QA Payment WordPress plugin through 1.28 accepts payment notifications without properly checking their authenticity. Because the check uses a merchant secret that is empty by default, an unauthenticated attacker can forge a confirmation and mark orders as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
WordPress sites that run the Sadad QA Payment plugin through version 1.28 and accept Sadad payments through it are exposed, especially where the merchant secret was never set. Sites that do not use this plugin can skip it.
No product ranges from the sources yet.
1.28 or lower, in the WordPress admin under Plugins or in wp-content/plugins/.1.28.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-103330")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.