The Payment Gateway for Idram WordPress plugin prior to version 2.1.6 fails to authenticate incoming payment notifications. Because the merchant credentials that form part of the checksum are empty by default, an attacker can generate a valid signature and cause the plugin to accept the notification as legitimate. This allows the attacker to falsely mark any order as paid or to force it into a failed state, thereby creating financial fraud or disrupting order flows. The flaw is a form of improper authentication that can be exploited by any user who can reach the payment confirmation endpoint.

Any WordPress installation that has the Payment Gateway for Idram plugin installed with a version older than 2.1.6. The vulnerability is tied to the plugin itself; upgrades to 2.1.6 or later remove the issue. The affected vendor product is listed only as an unknown provider of the Payment Gateway for Idram.

The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog and the EPSS score is < 1%, indicating limited public exploitation data. Nonetheless, because the flaw does not require privileged access and the endpoint is typically exposed over the public web when a site receives payments, the theoretical adversary could easily craft the required HTTP requests to trigger the behavior. The potential financial impact is significant, as orders may be incorrectly settled or denied. As a result, the risk level is high for sites that rely on the plugin for revenue collection, even if exploit evidence is sparse. The CVSS score of 5.3 indicates moderate severity.