Improper Authentication Vulnerability in iK Pay Gateway WordPress Plugin
CVE-2026-103306
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-103306?
The iK Pay Gateway WordPress plugin, prior to version 3.0.4, lacks adequate verification for payment gateway callbacks, which poses a significant security risk. This flaw allows attackers to impersonate legitimate payment notifications, enabling them to incorrectly mark orders as paid without actual transactions occurring. Furthermore, it allows for the manipulation of payment statuses for unprocessed orders, thereby jeopardizing the integrity of the payment process.
Affected Version(s)
Online Payments with iK Pay Gateway 0 < 3.0.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.