Threats tagged 'ghsa-9f34-8wwr-2wjq'

The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions before 7.0.2 contains a vulnerability where it does not verify the authenticity of incoming payment-provider notifications. This flaw allows unauthenticated attackers to forge payment-confirmation callbacks and mark orders as paid without actual payment. The vulnerability is identified as CWE-345 (Insufficient Verification of Data Authenticity) and has a CVSS 3.1 score of 7.5, indicating high severity.