Threats tagged 'ghsa-m8g2-r2r9-qg3j'

The BitPay Gateway for WooCommerce WordPress plugin versions through 4.1.3 has a vulnerability where it does not bind the payment provider's transaction confirmation to the specific order nor verify the confirmed payment amount. This flaw allows an unauthenticated attacker who possesses a valid low-value transaction to mark other arbitrary higher-value orders as paid without authorization.