Payment Gateway for Idram < 2.1.6 — Unauthenticated Arbitrary Order Status Manipulation

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Payment Gateway for Idram.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 2.1.6, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Payment Gateway for Idram to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Naoki Kawahigashi.

The Payment Gateway for Idram plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to 2.1.6. This is due to missing validation that the merchant secret key and receiving account are non-empty before accepting and verifying payment notification checksums, allowing an empty-string-based HMAC to be trivially reproduced, and absence of authentication on the failure webhook endpoint. This makes it possible for unauthenticated attackers to mark arbitrary orders as paid by forging a valid payment notification checksum, and force arbitrary orders into a failed state without any authentication.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. Oct 19, 2026

   CVE published

   Severity medium, CVSS 5.3

2. Nov 13, 2026

   Record last updated