Idram Payment Gateway CVE-2026-103302

Exploitation requires that the plugin's Idram merchant credentials (the secret used to compute the payment-notification checksum) remain empty, which is the plugin's default state in versions before 2.1.6 - so default/unconfigured installations are directly exploitable without authentication or user interaction. The attacker must be able to reach the plugin's payment-callback URL and needs valid target order identifiers to mark specific orders paid or failed. The principal limiting factor is configuration: merchants who have populated non-empty secret credentials would cause the checksum to be meaningfully verified, substantially reducing forgeability; the impact is also inherently bounded to order payment-state manipulation rather than data disclosure or site compromise.

Multiple signals converge on this being a moderate, not top-tier, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, but limited to a low integrity impact and no confidentiality or availability impact - consistent with the CWE-290 authentication-bypass description where empty default merchant credentials let an attacker forge valid payment-confirmation checksums. Publicly available exploit code exists (WPScan), which raises practical exploitability, but this CVE is NOT on CISA KEV and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation at time of analysis. No SSVC decision data was supplied. The key tension is between easy, POC-backed unauthenticated access and the genuinely narrow impact: an attacker can fraudulently mark arbitrary orders as paid or force them into a failed state, which is a business-logic/financial-fraud problem for the specific merchant rather than a server compromise. Net: a real and credible threat to affected Idram merchants (patch promptly), but the capped integrity-only impact and niche product footprint keep it well below critical remote-code-execution class issues.

Because the plugin ships with empty merchant credentials, the checksum protecting Idram payment callbacks is trivially satisfiable, so a remote unauthenticated attacker crafts a forged payment-notification request to the plugin's callback endpoint and marks their own unpaid order as 'paid', obtaining goods or services without paying. The same technique can be inverted to force arbitrary legitimate orders into a 'failed' state, disrupting the merchant's order flow. A public proof-of-concept is referenced by WPScan, lowering the effort required.