{"id":"CVE-2026-104651","aliases":["EUVD-2026-94178","GHSA-6pp4-6q7m-6492"],"status":"published","title":"Yaad Sarig Payment Gateway For WC \u003c 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR","description":"The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00152,"percentile":0.04419,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-10-07T06:00:05Z","modified":"2026-10-07T14:52:43Z","products":[{"vendor":"unknown","product":"yaad sarig payment gateway for wc"},{"vendor":"yaadsarig","product":"yaad sarig payment gateway for wc"}],"references":[{"url":"https://wpscan.com/vulnerability/be0e4e18-0bd7-455a-93f6-8f4a7f18b7e1/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104651"},{"url":"https://wpscan.com/vulnerability/be0e4e18-0bd7-455a-93f6-8f4a7f18b7e1"},{"url":"https://github.com/advisories/GHSA-6pp4-6q7m-6492"}],"sources":{"cve":[{"id":"CVE-2026-104651","title":"Yaad Sarig Payment Gateway For WC \u003c 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR","description":"The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.","status":"published","published":"2026-10-07T06:00:05.247Z","modified":"2026-10-07T10:09:57.91Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-94178","description":"The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.","status":"published","published":"2026-10-07T06:00:05Z","modified":"2026-10-07T10:09:57Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:35.509652Z"}],"ghsa":[{"id":"GHSA-6pp4-6q7m-6492","title":"The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify...","description":"The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.","status":"published","published":"2026-10-07T09:32:19Z","modified":"2026-10-07T12:31:57Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:12:54.084372Z"}],"nvd":[{"id":"CVE-2026-104651","description":"The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.","status":"published","published":"2026-10-07T07:16:57.857Z","modified":"2026-10-07T14:52:43.42Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:54.809359Z"}]}}