{"id":"CVE-2026-103306","published":"2026-10-26T07:17:07.093","lastModified":"2026-10-26T13:50:14.083","description":"The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/2d888e78-ed1f-4968-9bdc-19e9420f6956/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}