Threats tagged 'ghsa-h386-5mv5-whv9'

The Paystack WooCommerce Payment Gateway plugin for WordPress versions up to and including 5.8.5 is vulnerable to sensitive information exposure via the 'key' parameter. This vulnerability allows unauthenticated attackers to enumerate sequential order IDs and extract customer personally identifiable information (PII) such as billing name, email, phone number, billing and shipping addresses, and purchased product details. Exploitation requires that the merchant has enabled the optional custom metadata feature in the Paystack gateway settings.