What is GHSA-6pp4-6q7m-6492?

GHSA-6pp4-6q7m-6492 is a security advisory published by GitHub Security Advisories with Medium severity. The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify...

Which CVE IDs does GHSA-6pp4-6q7m-6492 cover?

GHSA-6pp4-6q7m-6492 covers the following CVE IDs: CVE-2026-104651. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6pp4-6q7m-6492?

GHSA-6pp4-6q7m-6492 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-6pp4-6q7m-6492MediumCVSS 4.3

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify...

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-104651 →

📋 Description

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-104651
https://wpscan.com/vulnerability/be0e4e18-0bd7-455a-93f6-8f4a7f18b7e1
https://github.com/advisories/GHSA-6pp4-6q7m-6492