Threats tagged 'ghsa-xpq3-q6vx-4qg3'

The CryptoCloud WordPress plugin versions 3.0.0 through 3.0.1 have a vulnerability where payment notifications are not properly authenticated. The plugin skips integrity checks if the webhook secret remains at its default empty value, allowing attackers to mark orders as paid or failed without actual payment.