CVE-2026-103302
Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 21, 2026
- Updated
- Oct 21, 2026
- Reserved
- Sep 30, 2026
Description
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-290 Authentication Bypass by Spoofing
Affected Products
| Product | Versions |
|---|---|
Payment Gateway for IdramUnknown |
|
References
- https://wpscan.com/vulnerability/0d15b11e-fcb2-44b4-b9c9-0210004d1694/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.