Description
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Thanh Toán Quét Mã QR Code Tự Động | ≤ 2.0.1 | — |
References
- https://wpscan.com/vulnerability/7c3f164c-8659-401d-b746-542e705c9e86/ exploit vdb-entry technical-description