WordPress Plugin Vulnerabilities

BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery

Description

The plugin does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.

Proof of Concept

Affects Plugins

Plugin icon
bdm-digital-payment-gateway
No known fix

References

CVE
CVE-2026-106010

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
fba20275-4836-4f19-aad9-c6f4e2c53b88

Timeline

Publicly Published
2026-10-16 (about 2 days ago)
Added
2026-10-09 (about 9 days ago)
Last Updated
2026-10-09 (about 9 days ago)

Other

Published
Title
Published
2024-03-20
Title
WooCommerce Cloak Affiliate Links < 1.0.34 - Missing Authorization to Unauthenticated Permalink Modification
Published
2026-08-18
Title
NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API
Published
2026-10-02
Title
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
Published
2024-09-06
Title
Cost Calculator Builder PRO < 3.2.2 - Unauthenticated Price Manipulation
Published
2021-03-23
Title
SecuPress < 2.0 - Unauthenticated Arbitrary IP Ban