CVE-2026-103306
iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
| Vendor | unknown |
| Product | online payments with ik pay gateway |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown online payments with ik pay gateway
Be the first to know when new unknown vulnerabilities affecting unknown online payments with ik pay gateway are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Online Payments with iK Pay Gateway
0 < 3.0.4
References
Credits
Naoki Kawahigashi WPScan