Authentication Bypass in Payment Gateway for Idram WordPress Plugin
CVE-2026-103302

Currently unrated

Key Information:

Vendor

WordPress
Status
Payment Gateway For Idram
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-103302?

The Payment Gateway for Idram WordPress plugin prior to version 2.1.6 lacks proper verification of incoming payment notifications. Due to default empty merchant credentials, this vulnerability allows attackers to forge valid payment confirmations. As a result, they can illegitimately mark any order as paid or force it into a failed state, undermining the integrity of payment processing and financial transactions for merchants using this plugin.

Affected Version(s)

Payment Gateway for Idram 0 < 2.1.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-103302 - Proof of Concept

References

https://wpscan.com/vulnerability/0d15b11e-fcb2-44b4-b9c9-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoki Kawahigashi
WPScan
.