Online Payments With Ik Pay Gateway
Monthly
Unauthenticated payment-forgery in the WordPress plugin Online Payments with iK Pay Gateway before 3.0.4 allows remote attackers to submit a crafted gateway callback that the plugin accepts without verifying its authenticity, marking arbitrary orders as paid without any money changing hands, or flipping arbitrary unprocessed orders to a failed state. The flaw is reachable on a default installation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, CWE-287), so no credentials or user interaction are needed; the only prerequisite is that the target site processes orders through the iK Pay callback flow. There is no CISA KEV entry and no confirmed working exploit code - only a public PoC reference via the WPScan advisory - and the practical damage depends on whether the store auto-fulfills orders on a 'paid' status.
Unauthenticated payment-forgery in the WordPress plugin Online Payments with iK Pay Gateway before 3.0.4 allows remote attackers to submit a crafted gateway callback that the plugin accepts without verifying its authenticity, marking arbitrary orders as paid without any money changing hands, or flipping arbitrary unprocessed orders to a failed state. The flaw is reachable on a default installation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, CWE-287), so no credentials or user interaction are needed; the only prerequisite is that the target site processes orders through the iK Pay callback flow. There is no CISA KEV entry and no confirmed working exploit code - only a public PoC reference via the WPScan advisory - and the practical damage depends on whether the store auto-fulfills orders on a 'paid' status.