Description
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 before 4.7.6 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Eupago Gateway For Woocommerce | 4.5.0 – < 4.7.6 | 4.7.6 |
References
- https://wpscan.com/vulnerability/065557b8-a29f-4c59-9289-2343d90447b1/ exploit vdb-entry technical-description