Unrated
Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
Announced Group revision 1
Original source ↗CVE-2026-104651
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104651
Yaad Sarig Payment Gateway For WC
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "Yaad Sarig Payment Gateway For WC",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.2.13",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-104651
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #11799 · Revision 1
- Added to Heist Feed
- Publisher date