{"id":"CVE-2026-103306","revision":"aa2a124650e04ac4aacc09c3d55f2f3b","records":[{"revision":"aa2a124650e04ac4aacc09c3d55f2f3b","observedAt":"2026-10-26T08:20:49.483+00:00","statement":{"source":"cve-program","id":"CVE-2026-103306","aliases":[],"title":"iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback","description":"The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.","state":0,"publishedAt":"2026-10-26T06:00:18.216+00:00","modifiedAt":"2026-10-26T06:00:18.216+00:00","affected":[{"ecosystem":"Vendor product","name":"Online Payments with iK Pay Gateway","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Online Payments with iK Pay Gateway\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.0.4\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/2d888e78-ed1f-4968-9bdc-19e9420f6956/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103306","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103306","identifiers":["CVE-2026-103306"]},"retained":false,"historicalAffected":[]}],"coverage":[]}