CVE-2026-103306: iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

Q: Are default installations affected?

Yes. The callback authenticity check is not properly performed on a default installation in versions before 3.0.4.

Q: What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can forge a payment gateway callback to mark arbitrary orders as paid without making a payment, or mark arbitrary unprocessed orders as failed.

Q: How can I determine whether my site is exposed?

Check whether the Online Payments with iK Pay Gateway WordPress plugin is installed and whether its version is earlier than 3.0.4. Sites using an affected version are exposed on the default installation.

Published Oct 26, 2026

Updated

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

Affected Software

1 affected component

iKhokha iKhokha Payment Gateway<3.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Online Payments with iK Pay Gateway WordPress plugin to a version that resolves this vulnerability.
Fixed in 3.0.4

Event History

Oct 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Are default installations affected?

Yes. The callback authenticity check is not properly performed on a default installation in versions before 3.0.4.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can forge a payment gateway callback to mark arbitrary orders as paid without making a payment, or mark arbitrary unprocessed orders as failed.

How can I determine whether my site is exposed?

Check whether the Online Payments with iK Pay Gateway WordPress plugin is installed and whether its version is earlier than 3.0.4. Sites using an affected version are exposed on the default installation.

CVE-2026-103306: iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

Affected Software

Remediation

Event History

Frequently Asked Questions

Are default installations affected?

What does an attacker need to exploit this issue?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Are default installations affected?

What does an attacker need to exploit this issue?

How can I determine whether my site is exposed?