CVE-2026-103330: Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Sadad QA Payment through version 1.28 are exposed when the merchant secret remains empty, which is the default configuration described for the plugin.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They can forge an incoming payment notification because the signed data is attacker-controlled and the default merchant secret is empty.
What is the impact of a successful exploit?
A successful attacker can cause orders to be marked as paid without an actual payment being made.