iK Pay Gateway EUVD-2026-109619

Exploitable against a DEFAULT installation of the Online Payments with iK Pay Gateway plugin (versions before 3.0.4) - the description explicitly states the callback authenticity is not verified on a default install, so no non-default configuration is needed. The specific precondition is that the site processes orders through the iK Pay payment-gateway callback flow, which the attacker forges. No authentication and no user interaction are required (PR:N/UI:N). Limiting factors: impact is restricted to order/payment state manipulation (mark paid, or mark unprocessed orders failed) with no data disclosure or service disruption; realistic damage depends on whether the store auto-fulfills on 'paid' status, and exploitation requires knowing or reaching the plugin's callback endpoint.

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, consistent with the description's 'default installation' and 'unauthenticated attackers' language - so the auth signal is independently corroborated by both NVD CVSS and the WPScan description. However, the base score is only 5.3 because impact is confined to integrity (I:L), with no confidentiality or availability effect: an attacker cannot read data or take the site down, only falsify order/payment state. No EPSS score was supplied and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', i.e. patch on a routine priority cycle rather than emergency. A PoC reference exists via WPScan but is not verified as working exploit code, so exploitability is plausible but unproven. Net: this is a real, easily-reached authentication-bypass affecting money-handling logic - materially dangerous to e-commerce sites that rely on this gateway for fulfillment - but it is a medium-severity, targeted-interest issue, not a high-CVSS-but-hollow finding and not a confirmed mass-exploitation event. SSVC-style read: exploitation=none observed, automatable=likely (unauthenticated forged HTTP callback), technical impact=partial.

An attacker places an order on a WooCommerce/WordPress store using the iK Pay gateway, then sends a forged payment-notification callback directly to the plugin's callback endpoint without completing (or making) any real payment; the plugin fails to verify callback authenticity and marks the order as paid, triggering fulfillment of goods or services for free. The same forged-callback capability can conversely be used to mark arbitrary unprocessed orders as failed, disrupting legitimate transactions. A WPScan PoC reference exists but is not verified as working exploit code; the low attack complexity and lack of authentication (AV:N/AC:L/PR:N/UI:N) make the scenario straightforward against default installs.