All vulnerabilities
CVE-2026-103306

iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

Unknown Online Payments with iK Pay GatewayNetwork & edge
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.0.4Fixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 3.0.4Online Payments with iK Pay GatewayCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

Text from CVE List

Affected versions 1

  • Online Payments with iK Pay Gatewayaffected: all versions before 3.0.4CVE List

References 1