Authorization Flaw in Yaad Sarig Payment Gateway for WooCommerce by WordPress
CVE-2026-104651
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 October 2026
Badges
What is CVE-2026-104651?
The Yaad Sarig Payment Gateway for WooCommerce plugin prior to version 2.2.13 contains an authorization bypass vulnerability that allows any authenticated user to access and modify orders belonging to other customers. This flaw arises from the plugin's failure to properly verify that the user requesting access to an order is indeed the owner of that order, which can lead to unauthorized actions and compromise customer transactions. It is critical for users of this plugin to update to the latest version to mitigate these risks and secure their WooCommerce platform.
Affected Version(s)
Yaad Sarig Payment Gateway For WC 0 < 2.2.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.