5.3
Moyenne
CVE-2026-106010 The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public…
Description
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| BDM Digital Payment Gateway 1.2 | 1.2.7 → 1.3.12 | Pas de correctif indiqué |