Threats tagged 'ghsa-x972-w82m-gqc5'

The Integrate PhonePe with WooCommerce WordPress plugin up to version 1.2.1 contains an authorization bypass vulnerability. It fails to verify that a payment transaction belongs to the order being marked as paid and does not authenticate payment-completion requests. This allows unauthenticated attackers to reuse a valid transaction to mark arbitrary orders as paid, bypassing payment requirements.