UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-103306
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-10-26T11:05:33.130612+00:00
- Cve id
- CVE-2026-103306
- First seen by Signal
- 2026-10-26T11:03:13+00:00
- Retrieved at
- 2026-10-26T11:07:52+00:00
- Published at
- 2026-10-26T07:17:07.093
- Last modified
- 2026-10-26T07:17:07.093
Explore deeper with Ninja Signal's threat intelligence graph