Description
The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Gateway for Vantiv on WC | ≤ 1.0.1 | — |
References
- https://wpscan.com/vulnerability/30ccd424-a0a1-40a9-93ab-5def94eb0073/ exploit vdb-entry technical-description