Threats tagged 'ghsa-wxfh-552r-23f6'

The Chikkili- Google Pay India for Woocommerce WordPress plugin up to version 1.0.6 contains a missing authorization vulnerability. It fails to verify that payment notifications originate from the legitimate payment provider before marking orders as paid. This flaw allows unauthenticated attackers to mark arbitrary orders as paid without making any actual payment.