Description
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | UniPAY Payment Gateway For WooCommerce | < 2.4 | 2.4 |
References
- https://wpscan.com/vulnerability/a7d61b5f-9e92-459c-8f6d-1c92ea94ef00/ exploit vdb-entry technical-description