Threats tagged 'ghsa-fpcc-wxm7-87wc'

The PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 do not verify the authenticity of payment notifications if the merchant secret is unset, which is the default configuration. This flaw allows unauthenticated attackers to forge payment confirmations and mark orders as paid without actual payment.