Read the docs
TI-2026-81937 Aliases CVE-2026-103330GHSA-6pxp-6v4v-67f3

Forged payment notifications in Sadad QA Payment mark orders as paid

Priority LOW 29CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications (CWE-345). The verification is keyed on a merchant secret that is empty by default, while the rest of the signed data is attacker-controlled. An unauthenticated remote attacker can forge a valid payment confirmation and mark orders as paid without payment. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSadad QA Payment1.28 – 1.28—No fix listedCNA
  • Sadad QA Payment VendorUnknown Affected 1.28 – 1.28 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Sadad QA Payment.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-103330
  2. 2026-10-28 Alias added: GHSA-6pxp-6v4v-67f3
  3. 2026-10-28 Weakness changed · CISA ADP
  4. 2026-10-28 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences