medium5.3
CVE-2026-106010
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset cred…
Impact
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.
Affected products
| Product | Affected versions |
|---|---|
| BDM Digital Payment Gateway WordPress Plugin | through 1.3.12 |
Versions were read from the advisory text. No structured product data has been published for this record yet.