Live › vulnerability › CVE-2026-106010
Go to dashboardThe BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not check credentials on its public payment-status update route, and treats unset credentials as valid. An unauthenticated attacker can mark arbitrary WooCommerce orders as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WooCommerce stores running the BDM Digital Payment Gateway plugin through version 1.3.12 in its default configuration are exposed. The flaw is in the public payment-status route, so any store using this gateway should be checked. Stores that do not use this plugin can skip it.
No product ranges from the sources yet.
1.3.12 or lower, in the WordPress admin plugins list or the plugin's main file header.1.3.12 if one is available; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-106010")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.