Threats tagged 'ghsa-c6r8-q9rq-vw5v'

The UniPAY Payment Gateway for WooCommerce WordPress plugin versions up to 2.3 does not properly verify payment notification authenticity. The plugin checks notification signatures against a merchant secret that is empty by default, enabling attackers to forge valid notifications and mark arbitrary orders as paid.