Threats tagged 'ghsa-6pxp-6v4v-67f3'

The Sadad QA Payment WordPress plugin versions through 1.28 contain a vulnerability where incoming payment notifications are not properly authenticated. This is due to the verification relying on a merchant secret that is empty by default and the rest of the signed data being attacker-controlled. As a result, unauthenticated attackers can forge valid payment confirmations and mark orders as paid without actual payment.