CVE-2026-103302
Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.
| Vendor | unknown |
| Product | payment gateway for idram |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown payment gateway for idram
Be the first to know when new unknown vulnerabilities affecting unknown payment gateway for idram are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Payment Gateway for Idram
0 < 2.1.6
References
Credits
Naoki Kawahigashi WPScan