BDM Digital Payment Gateway
BDM Digital Payment Gateway has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for BDM Digital Payment Gateway has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Enrico Marcolini. BDM Digital Payment Gateway is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-106010BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Missing Authorization
Read the full analysisVulnerability Records
BDM Digital Payment Gateway
Author
BDM Digital
This plugin allows you to accept payments with the BDM digital currency in your WooCommerce store. It generates QR codes for payments, performs automatic validations, and provides instant confirmations to the customer. Main features: * Automatic QR Code generation * Real-time payment validation * Compatible with BDM digital wallets * Direct integration with WooCommerce * Custom checkout page External services This plugin relies on the BDM Digital partner API (operated by Dourado Cash) to quote the BDM price, issue the payment code (QR Code) and confirm payments. All calls are made from your server and authenticated with the API key you configure; the API key is never sent to the visitor’s browser. Production: https://partner.douradocash.com.br/ Sandbox (only when Sandbox Mode is enabled): https://dev-partner.dourado.cash/ What is sent and when: When the BDM checkout page loads and when an order is placed: the asset code (e.g. BDM), to fetch the current quotation. When an order is placed: your partner e-mail, the order amount in BDM and the order number (as the payment description). While the customer waits for the payment: your partner e-mail and the payment code of that order, to check whether it was paid. No customer personal data (name, address, e-mail, phone) is sent to the API. Source JS/CSS jquery.toast.min.js: https://github.com/kamranahmedse/jquery-toast-plugin bootstrap.min.css: https://getbootstrap.com/ License This plugin is free software and is licensed under GPLv2 or later.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C