BDM Digital CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM BDM Digital CVE published 2026-10-19

CVE-2026-106010

CVE-2026-106010 is a vulnerability in the BDM Digital Payment Gateway WordPress plugin that allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment. The plugin does not verify credentials on its public payment-status update route and treats unset credentials as valid. This issue affects the default configuration.