BDM Digital Payment Gateway

BDM Digital Payment Gateway has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for BDM Digital Payment Gateway has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.

All of these findings were reported by Enrico Marcolini. BDM Digital Payment Gateway is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all BDM Digital Payment Gateway vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-106010

BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv1.3.13

BDM Digital Payment Gateway

BDM Digital

Author

BDM Digital

0.0(0)
0/100
Last Updated
2026-10-20 (4d ago)
Active Installs
10+
Downloads
1,239
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2025-06-18 (1y ago)

This plugin allows you to accept payments with the BDM digital currency in your WooCommerce store. It generates QR codes for payments, performs automatic validations, and provides instant confirmations to the customer. Main features: * Automatic QR Code generation * Real-time payment validation * Compatible with BDM digital wallets * Direct integration with WooCommerce * Custom checkout page External services This plugin relies on the BDM Digital partner API (operated by Dourado Cash) to quote the BDM price, issue the payment code (QR Code) and confirm payments. All calls are made from your server and authenticated with the API key you configure; the API key is never sent to the visitor’s browser. Production: https://partner.douradocash.com.br/ Sandbox (only when Sandbox Mode is enabled): https://dev-partner.dourado.cash/ What is sent and when: When the BDM checkout page loads and when an order is placed: the asset code (e.g. BDM), to fetch the current quotation. When an order is placed: your partner e-mail, the order amount in BDM and the order number (as the payment description). While the customer waits for the payment: your partner e-mail and the payment code of that order, to check whether it was paid. No customer personal data (name, address, e-mail, phone) is sent to the API. Source JS/CSS jquery.toast.min.js: https://github.com/kamranahmedse/jquery-toast-plugin bootstrap.min.css: https://getbootstrap.com/ License This plugin is free software and is licensed under GPLv2 or later.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C