Airwallex Online Payments Gateway
Monthly
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 accepts forged payment notifications and marks orders as paid when no webhook secret has been configured, allowing unauthenticated remote attackers to obtain goods or services without completing payment. The flaw is a business-logic integrity issue rather than a system-compromise bug: CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to falsified order/payment state. It is exploitable only on stores that have left the webhook secret empty, and publicly available exploit code exists (WPScan); there is no evidence of confirmed active exploitation in the wild.
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 accepts forged payment notifications and marks orders as paid when no webhook secret has been configured, allowing unauthenticated remote attackers to obtain goods or services without completing payment. The flaw is a business-logic integrity issue rather than a system-compromise bug: CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to falsified order/payment state. It is exploitable only on stores that have left the webhook secret empty, and publicly available exploit code exists (WPScan); there is no evidence of confirmed active exploitation in the wild.