Sadad QA Payment CVE-2026-103330

Exploitable against default installations where the merchant secret used for notification verification is empty, which the description states is the default; in that state an unauthenticated remote attacker can forge a validly 'signed' payment notification because the remaining signed data is attacker-controlled. The principal limiting factor is configuration: a deployment where the operator has set a non-empty merchant secret would break the forgery precondition. Exploitation also requires the store to be running the Sadad QA Payment plugin version 1.28 or earlier with its payment-confirmation callback reachable; no authentication and no user interaction are required.

This is a moderate-severity integrity flaw, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated abuse with no user interaction, and the 5.3 Medium score is driven entirely by a Low integrity impact (C:N/I:L/A:N) - no data exposure and no availability loss. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent priority rather than act_now/emergency. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of active or probable widespread exploitation; a public PoC reference (the WPScan entry) exists but is not verified as working exploit code, so PoC availability must not be read as active exploitation. The tag 'Information Disclosure' conflicts with the data: the mechanism and CVSS (C:N, I:L) describe payment-confirmation forgery (an integrity/business-logic fraud issue), not confidentiality loss - this discrepancy should be noted. Net: a genuine fraud-enabling bug for sites running this specific plugin, but its narrow deployment footprint and lack of confirmed exploitation keep real-world aggregate risk modest.

An unauthenticated attacker places an order through a store using the Sadad QA Payment plugin, then sends a crafted payment-notification callback to the plugin's confirmation endpoint. Because the signature verification is keyed on a merchant secret that is empty by default while the remaining signed fields are attacker-controlled, the forged notification validates and the order is marked paid without any real payment. A public PoC reference exists (WPScan); it is not verified as working exploit code.