Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103306— iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

Quick assessment

Affected
Unknown Online Payments with iK Pay Gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在默认安装下，WordPress 插件"Online Payments with iK Pay Gateway"3.0.4 版本之前的版本未能正确验证其支付网关回调的真实性，这使得未认证的攻击者能够伪造成功的支付通知，将任意订单标记为已支付（而实际上并未发生任何支付），并将任意未处理的订单标记为失败。

AI Predicted 8.1 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103306

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback
Source: CVE Program / CVE List V5
Vulnerability Description
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Online Payments with iK Pay Gateway 0 ~ 3.0.4 -

II. Public POCs for CVE-2026-103306

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103306

请登录查看更多情报信息。

Other References for CVE-2026-103306 (1)

Same Patch Batch · Unknown · 2026-10-26 · 7 CVEs total

CVE-2026-103300 5.3 MEDIUM Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via
CVE-2026-111974 5.3 MEDIUM GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency
CVE-2026-103299 nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery vi
CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forge
CVE-2026-103381 Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback
CVE-2026-103298 CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion

IV. Related Vulnerabilities

Same vendor: Unknown