Threats tagged 'ghsa-j2wf-m8xp-xm7q'

The FlxWoo WordPress plugin versions before 3.1.1 contain an improper authentication vulnerability where the plugin does not verify payment processor confirmation before marking orders as paid. This flaw allows unauthenticated attackers to complete WooCommerce orders without making a payment. The vulnerability is identified as CWE-287 and has a high severity score of 7.5. No official patch or remediation guidance is currently provided by the vendor.