Threats tagged 'ghsa-2qcj-76wq-79hr'

The Payment Gateway via Valitor for WooCommerce WordPress plugin versions before 1.9.41 contains a vulnerability where it does not properly validate payment callback authenticity. This is due to reliance on a verification secret with a hard-coded default value used by all stores that have not changed it. An unauthenticated attacker can exploit this to forge valid payment confirmations and mark arbitrary orders as paid.