BDM Payment Gateway EUVD-2026-104096

Exploitation requires that the target WordPress site runs the BDM Digital Payment Gateway plugin at or below version 1.3.12 alongside WooCommerce, and that the plugin's public payment-status update route is reachable. No authentication, credentials, or user interaction are needed because the route does not verify credentials and treats UNSET credentials as valid - which is the default, out-of-the-box state, so no special configuration change by the victim is required. The principal limiting factor is deployment scope: only sites with this specific plugin installed are affected, and impact is confined to WooCommerce order payment status (no code execution, no data disclosure).

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the 5.3 score reflects the integrity-only impact (C:N/I:L/A:N) - there is no data theft or service disruption, only unauthorized modification of order payment status. The exploit code is publicly available (WPScan), which raises the practical likelihood of opportunistic abuse, but the vulnerability is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active, widespread exploitation at time of analysis - POC availability and active exploitation are distinct signals. The decisive aggravating factor is that the flaw is exploitable in the DEFAULT configuration (unset credentials are treated as valid), removing the usual 'non-default config' mitigation. The decisive mitigating factor is prevalence: BDM Digital Payment Gateway is a niche WordPress/WooCommerce payment plugin with an unknown vendor in the CPE, so the real-world footprint is small. Net: for the specific merchants running this plugin this is a direct payment-fraud/revenue-loss risk worth prompt patching, but it is not a broad internet-scale emergency. Note: the input tag 'Information Disclosure' conflicts with the CVSS vector (C:N) and the description - this is an authorization/payment-bypass integrity issue, not information disclosure.

An attacker places an order on a WooCommerce store running the BDM Digital Payment Gateway plugin, then sends an unauthenticated HTTP request directly to the plugin's public payment-status update route; because unset credentials are treated as valid in the default configuration, the server marks the order as paid without any real payment. The merchant then fulfills and ships goods for an order that was never paid. Publicly available exploit code (WPScan) lowers the skill barrier, and the low attack complexity (AC:L, no authentication, no user interaction) makes this trivial to automate against known installations.