Threats tagged 'ghsa-f39h-p64c-xrvv'

The Payment Integration Wompi WordPress plugin up to version 4.0.1 fails to verify the authenticity of incoming payment notifications by default. This occurs because the callback's checksum relies on a merchant secret that is empty until manually configured. As a result, an unauthenticated attacker can forge payment notifications and mark arbitrary orders as paid.