{"id":"CVE-2026-106010","title":"BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery","summary":"The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooComm…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-862"],"product":"BDM Digital Payment Gateway","affected":["bdm_digital_payment_gateway >= 1.2.7 <= 1.3.12"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T09:26:31.346655Z"},"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T09:31:21.956Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106010","references":[{"url":"https://wpscan.com/vulnerability/fba20275-4836-4f19-aad9-c6f4e2c53b88/"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T07:09:59.593Z","epss":0.00182,"epssPercentile":0.07293,"slug":"CVE-2026-106010","body":"## Overview\n\nThe BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.\n\n## Affected\n\n- `bdm_digital_payment_gateway >= 1.2.7 <= 1.3.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}