CVE-2026-103302None▾ SunlitThe Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticate…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.
payment_gateway_for_idram < 2.1.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113703Critical· 9.3SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
CVE-2026-111623Medium· 5.6Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance
CVE-2026-111691High· 7.4WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header
CVE-2026-102764Critical· 9.3Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
CVE-2026-102946Critical· 9.1joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards
CVE-2026-84731Critical· 9.8An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header