{"id":"CVE-2026-103330","kind":"vulnerability","aliases":["CVE-2026-103330"],"related":[],"title":"Sadad QA Payment WordPress plugin: forged payment notices mark orders paid","description":"The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.","summary":"The Sadad QA Payment WordPress plugin through 1.28 accepts payment notifications without properly checking their authenticity. Because the check uses a merchant secret that is empty by default, an unauthenticated attacker can forge a confirmation and mark orders as paid without paying.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","payments","wordpress"],"not_affected_if":["merchant-secret-set","plugin-not-installed"],"how_to_check":"- Check whether the Sadad QA Payment plugin is installed and its version is `1.28` or lower, in the WordPress admin under Plugins or in `wp-content/plugins/`.\n- Check whether the plugin's merchant secret setting is empty.","fix":"- unknown: the sources do not name a patched version. Check the plugin vendor or WordPress.org for an update past `1.28`.\n- Until a fix is available, disable the plugin or set a strong merchant secret if the plugin supports it.","status":"open","published_at":"2026-10-28T11:17:13+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","triaged_at":"2026-10-28T11:33:37+00:00","updated_at":"2026-10-28T11:33:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T11:33:37Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched version. Check the plugin vendor or WordPress.org for an update past `1.28`.\n- Until a fix is available, disable the plugin or set a strong merchant secret if the plugin supports it.","reach":"internet","title":"Sadad QA Payment WordPress plugin: forged payment notices mark orders paid","impact":"medium","summary":"The Sadad QA Payment WordPress plugin through 1.28 accepts payment notifications without properly checking their authenticity. Because the check uses a merchant secret that is empty by default, an unauthenticated attacker can forge a confirmation and mark orders as paid without paying.","category":"package","nicknames":[],"who_cares":["wordpress","ecommerce","payments"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker marks orders paid without paying for goods.","analyst_note":"Confirm the fixed plugin version and whether the merchant secret is empty by default in released builds, using the NVD entry and the plugin's changelog.","how_to_check":"- Check whether the Sadad QA Payment plugin is installed and its version is `1.28` or lower, in the WordPress admin under Plugins or in `wp-content/plugins/`.\n- Check whether the plugin's merchant secret setting is empty.","needs_analyst":true,"not_affected_if":["plugin-not-installed","merchant-secret-set"],"who_is_affected":"WordPress sites that run the Sadad QA Payment plugin through version 1.28 and accept Sadad payments through it are exposed, especially where the merchant secret was never set. Sites that do not use this plugin can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3340,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103330':14A,17A '-2026':13A,16A '1.28':29B,71C 'accept':30B 'allow':107C 'attack':52B,105C,109C 'attacker-control':104C 'authent':37B,77C 'check':35B,40B 'confirm':56B,114C 'control':106C 'correct':74C 'cve':12A,15A 'data':102C 'default':49B,95C 'ecommerc':18B 'empti':47B,93C 'forg':6A,54B,111C 'incom':79C 'key':86C 'mark':9A,58B,116C 'merchant':43B,89C 'notic':8A 'notif':32B,81C 'order':10A,59B,117C 'packag':19B 'paid':11A,61B,119C 'pay':63B 'payment':3A,7A,20B,25B,31B,67C,80C,121C 'plugin':5A,27B,69C 'proper':34B 'qa':2A,24B,66C 'rest':98C 'sadad':1A,23B,65C 'secret':44B,90C 'sign':101C 'unauthent':51B,108C 'use':41B 'valid':113C 'verif':84C 'verifi':75C 'without':33B,62B,120C 'wordpress':4A,21B,26B,68C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites that run the Sadad QA Payment plugin through version 1.28 and accept Sadad payments through it are exposed, especially where the merchant secret was never set. Sites that do not use this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103330","severity":null,"published_at":"2026-10-28T11:17:13+00:00","modified_at":"2026-10-28T11:17:13+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","fetched_at":"2026-10-28T11:32:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}