CVE-2026-103330
CVE-2026-103330 · Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.
CVSS 5.3 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
sadad qa payment
- Versions
- ≥ 1.28, ≤ 1.28: Affected (semver)
No fix published