Threats tagged 'ghsa-x54m-fgf3-986q'

The WooCommerce PayPal Pro Payment Gateway plugin versions before 4.1.1 have an unauthenticated payment bypass vulnerability. This flaw allows remote attackers to mark unpaid orders as paid by exploiting the pp_capture_order AJAX handler, which only requires a public checkout nonce and does not properly validate the PayPal capture response status. As a result, attackers can trigger order fulfillment without actual payment, causing direct financial loss to merchants.