Threats tagged 'ghsa-x965-w74v-3qc3'

A vulnerability in Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before version 6.4.1 allows unauthenticated attackers to forge webhook requests due to improper cryptographic signature verification in the recurring-payment webhook handler. This flaw arises when no local webhook secret is stored, causing the code to compute an HMAC with an empty string and use a loose comparison instead of a secure hash comparison. Exploitation can lead to cancellation of active WooCommerce subscriptions by sending crafted recurring.agreement-stopped.v1 events.