Description
The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Easy PayPal & Stripe Buy Now Button | 1.8 – < 2.0.6 | 2.0.6 |
References
- https://wpscan.com/vulnerability/7c1faee8-628a-41dc-a5f0-afbc56480a18/ exploit vdb-entry technical-description