Threats tagged 'ghsa-9jq5-vqj9-9f7c'

The Order Tracking WordPress plugin versions before 3.6.0 have a vulnerability where the plugin does not verify that a PayPal payment notification was actually sent to the merchant's account or that the payment amount matches the order total before marking an order as paid. This flaw allows unauthenticated attackers to mark arbitrary orders as paid by making a trivial payment to their own PayPal account.