Threats tagged 'ghsa-xvqw-hjj4-j538'

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin up to version 2.0.1 has a vulnerability where it does not properly verify the authenticity of incoming bank-transfer payment notifications by default. This flaw allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without authorization.