Description
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
Published: 2026-10-07
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized manipulation of customer orders
Action: Apply patch
AI Analysis

Impact

The Yaad Sarig Payment Gateway For WC plugin before version 2.2.13 lacks a proper authorization check when processing order payments. As a result, anyone who is logged in to the WordPress site can act on orders that do not belong to them, allowing the creation or alteration of payment actions for other customers. This flaw is an IDOR that directly compromises the integrity of order data.

Affected Systems

The vulnerability affects the WordPress plugin Yaad Sarig Payment Gateway For WC for all releases older than 2.2.13. Any installation that uses this plugin and has an unauthenticated or subscriber role login is potentially impacted. Administrators should verify the installed plugin version and upgrade if it is outdated.

Risk and Exploitability

An authenticated user, including those with subscriber privileges, can exploit this flaw simply by submitting a request to the vulnerable endpoint. The CVSS score of 4.3 categorizes the risk as medium; the EPSS score is not publicly available, and the issue is not listed in the CISA KEV catalog. Nevertheless, because the flaw allows alteration of order payment information without additional prerequisites, it remains a realistic threat to the integrity of financial transactions.

Generated by OpenCVE AI on October 7, 2026 at 12:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Yaad Sarig Payment Gateway For WC to version 2.2.13 or newer
  • Restrict the order payment‑processing functions so that only users with administrator privileges can invoke them
  • Enable detailed logging of order payment actions and periodically audit the logs for unauthorized activity

Generated by OpenCVE AI on October 7, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions yaad Sarig Payment Gateway For Wc
Vendors & Products Wordpress-extensions
Wordpress-extensions yaad Sarig Payment Gateway For Wc

Wed, 07 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 07 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-639

Wed, 07 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
Title Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
References

Subscriptions

Wordpress-extensions Yaad Sarig Payment Gateway For Wc
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-07T10:09:57.910Z

Reserved: 2026-10-02T06:32:20.196Z

Link: CVE-2026-104651

cve-icon Vulnrichment

Updated: 2026-10-07T09:58:36.426Z

cve-icon NVD

Status : Deferred

Published: 2026-10-07T07:16:57.857

Modified: 2026-10-07T14:52:43.420

Link: CVE-2026-104651

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:30:14Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key