CVE-2026-103302: Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

Q: Who can exploit this issue?

An unauthenticated attacker can forge payment notifications. No legitimate Idram payment or authenticated access is required.

Q: Are sites affected if the Idram gateway is not configured?

Yes. Forged notifications can mark arbitrary orders as paid or force them into a failed state regardless of the gateway's configuration.

Q: How can I determine whether my site is vulnerable?

Sites using Payment Gateway for Idram versions earlier than 2.1.6 are affected. Check the installed plugin version.

Published Oct 21, 2026

Updated

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.

Affected Software

1 affected component

Payment Gateway for Idram<2.1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Payment Gateway for Idram WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.1.6

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can forge payment notifications. No legitimate Idram payment or authenticated access is required.

Are sites affected if the Idram gateway is not configured?

Yes. Forged notifications can mark arbitrary orders as paid or force them into a failed state regardless of the gateway's configuration.

How can I determine whether my site is vulnerable?

Sites using Payment Gateway for Idram versions earlier than 2.1.6 are affected. Check the installed plugin version.

CVE-2026-103302: Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are sites affected if the Idram gateway is not configured?

How can I determine whether my site is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are sites affected if the Idram gateway is not configured?

How can I determine whether my site is vulnerable?