---
id: CVE-2026-106010
title: >-
  BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment
  Confirmation Forgery
summary: >-
  The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not
  verify the credentials on its public payment-status update route and treats
  unset credentials as valid, allowing unauthenticated attackers to mark
  arbitrary WooComm…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
product: BDM Digital Payment Gateway
affected:
  - bdm_digital_payment_gateway >= 1.2.7 <= 1.3.12
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T09:26:31.346655Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:31:21.956Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106010'
references:
  - url: 'https://wpscan.com/vulnerability/fba20275-4836-4f19-aad9-c6f4e2c53b88/'
tags:
  - cve.org
ingestedAt: '2026-10-19T07:09:59.593Z'
epss: 0.00182
epssPercentile: 0.07293
---

## Overview

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.

## Affected

- `bdm_digital_payment_gateway >= 1.2.7 <= 1.3.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.