Threats tagged 'ghsa-7whv-72vx-cc4j'

wePOS (Point Of Sale for WooCommerce) versions before 2.0.3 have a missing authorization vulnerability in the REST API endpoint wepos/v1/payment/process. This flaw allows authenticated vendor-level users with the publish_shop_orders capability to mark arbitrary orders as paid and completed by submitting another order's ID. Exploitation triggers the order completion lifecycle, including stock reduction and granting paid-order access, without actual payment.