Bdm Digital Payment Gateway
Monthly
WooCommerce orders can be marked as paid without payment by unauthenticated attackers on WordPress sites running BDM Digital Payment Gateway through 1.3.12. The plugin's public payment-status update route does not verify credentials and treats unset credentials as valid in the default configuration, so no special setup is required; no CISA KEV entry is provided, but publicly available exploit code exists. Impact is an integrity-only change to WooCommerce order payment status on sites with this specific plugin, with no code execution or data disclosure.
WooCommerce orders can be marked as paid without payment by unauthenticated attackers on WordPress sites running BDM Digital Payment Gateway through 1.3.12. The plugin's public payment-status update route does not verify credentials and treats unset credentials as valid in the default configuration, so no special setup is required; no CISA KEV entry is provided, but publicly available exploit code exists. Impact is an integrity-only change to WooCommerce order payment status on sites with this specific plugin, with no code execution or data disclosure.