{"id":"CVE-2026-104651","revision":"9411de7f5eb64e75adbcf01dd6090487","records":[{"revision":"9411de7f5eb64e75adbcf01dd6090487","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104651","aliases":[],"title":"Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR","description":"The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.","state":0,"publishedAt":"2026-10-07T06:00:05.247+00:00","modifiedAt":"2026-10-07T10:09:57.91+00:00","affected":[{"ecosystem":"Vendor product","name":"Yaad Sarig Payment Gateway For WC","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Yaad Sarig Payment Gateway For WC\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.2.13\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/be0e4e18-0bd7-455a-93f6-8f4a7f18b7e1/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104651","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104651","identifiers":["CVE-2026-104651"]},"retained":false,"historicalAffected":[]}],"coverage":[]}