CVE-2026-104651: Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit the affected payment-processing actions, including users with only the Subscriber role. The attacker does not need to own the order they target.
Which orders are at risk?
Orders belonging to other customers are at risk because the plugin does not verify that the requesting user is authorized to act on the target order. An authenticated attacker can act on and alter those orders through affected payment-processing actions.
Are installations using the default WordPress subscriber role affected?
Yes. Subscribers are explicitly included among the authenticated users able to exploit the issue, so sites that allow subscriber accounts may expose order-processing actions to low-privileged users.
What version should be remediated?
Update the Yaad Sarig Payment Gateway For WC plugin to version 2.2.13 or later. Versions before 2.2.13 are affected.