EUVD-2026-111970
GHSA-6pxp-6v4v-67f3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlace order on target store
-
ExploitCraft forged payment notification
-
ExecutionSignature validates against empty default secret
-
ImpactOrder marked paid without payment
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Exploitable against default installations where the merchant secret used for notification verification is empty, which the description states is the default; in that state an unauthenticated remote attacker can forge a validly 'signed' payment notification because the remaining signed data is attacker-controlled. The principal limiting factor is configuration: a deployment where the operator has set a non-empty merchant secret would break the forgery precondition. Exploitation also requires the store to be running the Sadad QA Payment plugin version 1.28 or earlier with its payment-confirmation callback reachable; no authentication and no user interaction are required. |
| Impact | This is a moderate-severity integrity flaw, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated abuse with no user interaction, and the 5.3 Medium score is driven entirely by a Low integrity impact (C:N/I:L/A:N) - no data exposure and no availability loss. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent priority rather than act_now/emergency. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of active or probable widespread exploitation; a public PoC reference (the WPScan entry) exists but is not verified as working exploit code, so PoC availability must not be read as active exploitation. The tag 'Information Disclosure' conflicts with the data: the mechanism and CVSS (C:N, I:L) describe payment-confirmation forgery (an integrity/business-logic fraud issue), not confidentiality loss - this discrepancy should be noted. Net: a genuine fraud-enabling bug for sites running this specific plugin, but its narrow deployment footprint and lack of confirmed exploitation keep real-world aggregate risk modest. |
| Exploit ScenarioDerived | An unauthenticated attacker places an order through a store using the Sadad QA Payment plugin, then sends a crafted payment-notification callback to the plugin's confirmation endpoint. Because the signature verification is keyed on a merchant secret that is empty by default while the remaining signed fields are attacker-controlled, the forged notification validates and the order is marked paid without any real payment. A public PoC reference exists (WPScan); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unauthenticated attackers can forge a valid payment confirmation and mark store orders as paid without any payment in the Sadad QA Payment WordPress plugin through version 1.28, because the authenticity check on incoming payment notifications is keyed on a merchant secret that is empty by default while the remaining signed data is attacker-controlled. Scored CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), the flaw is exploitable against default installations with a reachable confirmation callback, but a deployment where the operator has configured a non-empty merchant secret breaks the forgery precondition. A public PoC reference exists (a WPScan vulnerability entry); it is not verified as working exploit code, and the vuln.today priority label is 'this_month' - a moderate-severity integrity issue rather than a top-tier emergency.
RemediationAI
No vendor-released patch was identified at time of analysis: the plugin is affected through 1.28 and the supplied sources list no fixed version, so operators should treat any installed copy at or below 1.28 as unpatched and watch the WPScan advisory at https://wpscan.com/vulnerability/0681f5a8-a1cd-44b0-b7c8-c3eacbd9e96a/ for a fixed release. The assessment notes that a deployment where the operator has set a non-empty merchant secret breaks the forgery precondition, so configuring a non-empty secret is the most direct compensating control where the plugin exposes such a setting - with the trade-off that the supplied data does not confirm where or how that secret is configured, and an incorrectly chosen value could break legitimate notification processing and leave real payments unrecorded. Where the secret cannot be set reliably, disable the plugin until a patched version ships, accepting that checkout via this gateway stops working, and in the interim do not fulfil orders on plugin-recorded paid status alone: reconcile each order against the gateway's own transaction records before shipping. Restricting or blocking external access to the payment-confirmation callback reduces exposure but will also block legitimate gateway notifications unless the gateway's source addresses are explicitly allowed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The target is a WordPress payment plugin that receives server-to-server payment notifications from the Sadad QA gateway and, on a successful verification, transitions an order to a paid state. As described, that verification is a signature/authenticity check keyed on a merchant secret, but the secret is empty by default and the rest of the signed payload is supplied by the caller - so an attacker who controls every signed field can produce data that the plugin's check accepts, with the empty key contributing nothing to the security of the computation. The supplied data does not assign a CWE; the flaw class is defective verification of the authenticity of a payment notification (an authentication/authorization bypass in the payment-confirmation flow), and the practical consequence is integrity-only: order payment state can be falsified, with no confidentiality or availability impact recorded in the CVSS vector (C:N/I:L/A:N). CPE data records the affected component as cpe:2.3:a:unknown:sadad_qa_payment with an unrecorded vendor and a wildcard version, and EUVD lists the affected range as Sadad QA Payment 1.28 and below. The input does not state how the plugin is invoked beyond the confirmation callback, so preconditions beyond default configuration and callback reachability are not confirmed.
Know when Sadad Qa Payment gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote, low-complexity, unauthenticated forgery with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is limited integrity (order status altered, I:L) with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
DescriptionCVE.org
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB