Asaas Gateway For Woocommerce
Monthly
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on stores running the Asaas Gateway for WooCommerce plugin before 2.7.8, because the plugin's payment webhook accepts an empty access token under its default configuration and never confirms that the notified payment actually belongs to the order it updates (CWE-287 improper authentication). Exploitation needs only the vulnerable plugin installed, active, and network-reachable in its default state, and publicly available exploit code exists; CISA's SSVC decision data records no observed exploitation and EPSS is low at 0.22% (12th percentile). The impact is confined to integrity of order payment status - no data disclosure or availability loss - but stores that auto-fulfill or auto-provision on a 'paid' status can suffer fraudulent fulfillment and revenue loss.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on stores running the Asaas Gateway for WooCommerce plugin before 2.7.8, because the plugin's payment webhook accepts an empty access token under its default configuration and never confirms that the notified payment actually belongs to the order it updates (CWE-287 improper authentication). Exploitation needs only the vulnerable plugin installed, active, and network-reachable in its default state, and publicly available exploit code exists; CISA's SSVC decision data records no observed exploitation and EPSS is low at 0.22% (12th percentile). The impact is confined to integrity of order payment status - no data disclosure or availability loss - but stores that auto-fulfill or auto-provision on a 'paid' status can suffer fraudulent fulfillment and revenue loss.