CVE-2026-103306
CVE-2026-103306 · iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
CVSS 5.3 · Moyenne · EPSS 0,1% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
online payments with ik pay gateway
- Versions du logiciel
- ≥ 0, < 3.0.4: Concernée (semver)
Mettez à jour vers 3.0.4