WordPress Plugin Vulnerabilities

Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR

Description

The plugin does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.

Proof of Concept

Affects Plugins

Plugin icon
yaad-sarig-payment-gateway-for-wc
Fixed in 2.2.13

References

CVE
CVE-2026-104651

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ryan Fabella
Submitter
Ryan Fabella
Verified
Yes
WPVDB ID
be0e4e18-0bd7-455a-93f6-8f4a7f18b7e1

Timeline

Publicly Published
2026-10-05 (about 2 days ago)
Added
2026-10-05 (about 1 day ago)
Last Updated
2026-10-05 (about 1 day ago)

Other

Published
Title
Published
2026-07-22
Title
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 2.3.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-01-02
Title
Dolcino <= 1.6 - Authenticated (subscriber+) Insecure Direct Object Reference
Published
2025-07-01
Title
Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Published
2023-07-26
Title
ACF Photo Gallery Field < 2.0 - Subscriber+ UserMeta Update
Published
2025-05-13
Title
PeepSo Core: File Uploads < 6.4.6.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download