CVE-2026-106010: BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the BDM Digital Payment Gateway plugin through version 1.3.12 are exposed in the default configuration, particularly sites where WooCommerce orders can be reached through the plugin's public payment-status update route.
What does an attacker need to exploit it?
An attacker does not need authentication, credentials, or user interaction. They can exploit the public payment-status update route because unset credentials are accepted as valid.
What is the impact of successful exploitation?
An attacker can mark arbitrary WooCommerce orders as paid without an actual payment. The provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.
How can I determine whether my site is affected?
Check whether the BDM Digital Payment Gateway WordPress plugin is installed and whether its version is 1.3.12 or earlier. The issue affects the plugin's default configuration.