CVE-2026-104651 in Yaad Sarig Payment Gateway for WC Plugin
Summary
by MITRE • 10/07/2026
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The Yaad Sarig Payment Gateway for WooCommerce plugin version 2.2.13 and earlier contains a critical authorization bypass vulnerability that fundamentally compromises the integrity of e-commerce transactions. This flaw stems from an insecure direct object reference mechanism where the application fails to verify whether the authenticated user initiating a payment processing action is the legitimate owner of the target order. In secure web applications, every request involving sensitive data or state changes must be validated against access control policies to ensure that users can only interact with resources explicitly assigned to them. The absence of this verification allows any logged-in user, including those with minimal privileges such as subscribers, to manipulate orders belonging to other customers by simply modifying the order identifier in their requests.
From a technical perspective, this vulnerability represents a classic case of broken access control where server-side validation is neglected during critical business logic execution. When a payment gateway processes an order, it typically receives parameters identifying the specific transaction or order ID involved. The vulnerable implementation accepts these identifiers without cross-referencing them against the user session's associated data. Consequently, an attacker can enumerate valid order IDs and submit requests to modify status, process payments, or cancel transactions for orders they do not own. This lack of ownership verification undermines the core security principle that users should only have access to their own private resources, creating a pathway for unauthorized state changes within the e-commerce platform.
The operational impact of this vulnerability is severe, potentially leading to financial fraud and significant reputational damage for merchants using the plugin. Attackers can exploit this flaw to alter order statuses, such as marking unpaid orders as paid or canceling legitimate customer purchases. This could result in lost revenue if goods are shipped without payment being properly secured, or it could cause inventory discrepancies that disrupt business operations. Furthermore, because the vulnerability affects authenticated users, it is relatively easy for malicious actors with low-level accounts to execute these attacks, making exploitation straightforward and scalable. The ability to act on behalf of other customers also raises serious concerns regarding data privacy and compliance with regulations such as GDPR or PCI DSS, which mandate strict controls over how customer financial information and transactional history are handled.
To mitigate this risk, immediate action is required by updating the Yaad Sarig Payment Gateway plugin to version 2.2.13 or later, where these authorization checks have presumably been implemented. In addition to patching, developers should enforce robust server-side access control mechanisms for all order-related endpoints. This involves validating that the user ID associated with the current session matches the owner ID of the target order before processing any payment actions. Implementing strict input validation and utilizing unique, unpredictable identifiers for orders can further reduce the risk of enumeration attacks. Security teams should also monitor logs for unusual patterns in order modifications originating from low-privilege accounts to detect potential exploitation attempts early. Adhering to industry standards such as CWE-639, which addresses authorization bypass through confusion of user identity, and mapping these controls against MITRE ATT&CK techniques related to privilege escalation or account manipulation will help ensure comprehensive protection against similar vulnerabilities in the future.