---
id: CVE-2026-103330
title: >-
  Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation
  via Signature Bypass
summary: >-
  The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify
  the authenticity of incoming payment notifications, as the verification is
  keyed on a merchant secret that is empty by default and the rest of the signed
  data i…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-345
product: Sadad QA Payment
affected:
  - sadad_qa_payment >= 1.28 <= 1.28
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T17:37:05.689292Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:47:59.887Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103330'
references:
  - url: 'https://wpscan.com/vulnerability/0681f5a8-a1cd-44b0-b7c8-c3eacbd9e96a/'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.349Z'
---

## Overview

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.

## Affected

- `sadad_qa_payment >= 1.28 <= 1.28`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.