Threats tagged 'ghsa-c348-5968-fp8m'

The Casso Flow WordPress plugin versions before 4.2.0 have a vulnerability where incoming bank-transfer payment notifications are not properly authenticated. The token used for verification is empty by default, enabling unauthenticated attackers to forge notifications and mark any pending WooCommerce order as paid regardless of the actual payment method.