Threats tagged 'ghsa-rxc3-24xx-6g22'

The UniPAY Payment Gateway for WooCommerce WordPress plugin versions before 2.4 lacks authorization checks when returning an order's order-received URL based on an attacker-supplied order ID. This vulnerability exposes the order's secret key in the redirect URL and allows unauthenticated attackers to enumerate orders and access customers' personal information including name, email address, phone number, and address.