Payment Gateway For Idram
Monthly
Unauthenticated payment-state forgery in the Payment Gateway for Idram WordPress plugin before 2.1.6 lets remote attackers mark arbitrary orders as paid - or force them into a failed state - by submitting forged payment notifications. The root cause is that the merchant credentials used to compute the notification checksum are empty by default, so no meaningful signature check occurs on unconfigured installations; an attacker only needs the callback URL and a target order identifier. Publicly available exploit code exists and WPScan documented the issue, with a CVSS of 5.3 reflecting integrity-only impact (C:N/I:L/A:N) bounded to WooCommerce-style order payment status rather than data disclosure or site takeover; EPSS and KEV data were not provided, and the independent assessment rates this a moderate, not top-tier, priority.
Unauthenticated payment-state forgery in the Payment Gateway for Idram WordPress plugin before 2.1.6 lets remote attackers mark arbitrary orders as paid - or force them into a failed state - by submitting forged payment notifications. The root cause is that the merchant credentials used to compute the notification checksum are empty by default, so no meaningful signature check occurs on unconfigured installations; an attacker only needs the callback URL and a target order identifier. Publicly available exploit code exists and WPScan documented the issue, with a CVSS of 5.3 reflecting integrity-only impact (C:N/I:L/A:N) bounded to WooCommerce-style order payment status rather than data disclosure or site takeover; EPSS and KEV data were not provided, and the independent assessment rates this a moderate, not top-tier, priority.