CVE-2026-103306

{
  "etk_id": "ETK-2026-2638",
  "cve_id": "CVE-2026-103306",
  "display_id": "CVE-2026-103306",
  "ghsa_id": "GHSA-xw2m-gwmp-p7g6",
  "euvd_id": "EUVD-2026-109619",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper callback authentication in Online Payments with iK Pay Gateway",
  "summary": "Online Payments with iK Pay Gateway versions earlier than 3.0.4 do not adequately authenticate payment callback messages. On default installations, an unauthenticated attacker may falsify payment results and change arbitrary orders to paid or failed.",
  "mitigation": "Update the Online Payments with iK Pay Gateway WordPress plugin to version 3.0.4 or later. Restrict access to payment callback endpoints where deployment architecture permits.",
  "vendor": null,
  "product": "Online Payments with iK Pay Gateway",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.0.4"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.0.4"
      ],
      "package_name": "Online Payments with iK Pay Gateway",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.010611466666666666,
  "t0_at": "2026-10-26T06:00:18.216000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-26T09:42:23.443140+00:00",
      "days": 0.15422716597222222,
      "is_lower_bound": false,
      "measured_at": "2026-10-26T06:00:18.216000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-26T06:00:18.216000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-26T06:00:18.216000+00:00",
      "url": "https://github.com/advisories/GHSA-xw2m-gwmp-p7g6"
    }
  }
}