CVE-2026-106010 BDM Digital CVE debrief

Who should care

Defenders responsible for WordPress installations with the BDM Digital Payment Gateway plugin should assess exposure and verify the configuration of the plugin to prevent unauthorized payment status updates. They should also ensure that only authorized users can update payment statuses and monitor for unauthorized payment status updates.

Why it matters

CVE-2026-106010 is a vulnerability in the BDM Digital Payment Gateway WordPress plugin that allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment. Defenders responsible for WordPress installations with the plugin should assess exposure and verify the configuration of the plugin to prevent unauthorized payment status updates.

• Defenders need to verify the configuration of the BDM Digital Payment Gateway WordPress plugin to prevent unauthorized payment status updates.
• Defenders should monitor for unauthorized payment status updates to detect potential exploitation.

Technical summary

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration. This issue affects WordPress installations with the plugin, and defenders should assess exposure and verify the configuration of the plugin to prevent unauthorized payment status updates. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM.

Defensive priority

Defenders should prioritize verifying the configuration of the BDM Digital Payment Gateway WordPress plugin and ensuring that only authorized users can update payment statuses.

Recommended defensive actions

• Verify the configuration of the BDM Digital Payment Gateway WordPress plugin
• Ensure that only authorized users can update payment statuses
• Monitor for unauthorized payment status updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The WPScan reference provides additional details about the vulnerability. Evidence is limited, and defenders should verify the configuration of the BDM Digital Payment Gateway WordPress plugin and ensure that only authorized users can update payment statuses. The vulnerability affects the default configuration, and defenders need to assess exposure and verify the configuration of the plugin to prevent unauthorized payment status updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.