Threats tagged 'ghsa-qxp3-7pvj-q7qx'

The Payex Payment Gateway for Woocommerce WordPress plugin versions through 1.2.10 fails to properly verify the authenticity of incoming payment notifications. This is due to reliance on a validation secret that is empty by default, which allows unauthenticated attackers to forge payment confirmations and mark orders as paid without authorization.