Vulnerability · Published Oct 19, 2026 · Assigned by WPScan
CVE-2026-106010BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
Medium 5.3
In plain English
A medium-severity missing authorization in BDM Digital Payment Gateway from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 92.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | BDM Digital Payment Gateway | 1.2.7 – through 1.3.12 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/fba20275-4836-4f19-aad9-c6f4e2c53b88/ exploit, vdb-entry, technical-description