Threats tagged 'ghsa-grcx-5pw5-xxrw'

The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress contains a vulnerability in all versions up to and including 1.0.3 that allows unauthenticated attackers to bypass payment verification. This occurs because the plugin fails to properly verify payment status via server-side validation on the /wc-api/bp-payeer-gateway-callback endpoint. Exploitation can lead to unpaid orders being marked as paid, resulting in revenue loss for merchants.