CVE-2026-106010: medium-severity vulnerability in BDM Digital Payment Gateway
BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.2%
exploitation probability
0.2%top 92% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · BDM Digital Payment Gatewaypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/fba20275-4836-4f19-aad9-c6f4e2c53b88/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.