Campay Shortcode Payment Gateway
Monthly
Unauthenticated attackers can forge Mobile Money payment confirmations against WordPress sites running the CamPay Shortcode Payment Gateway plugin before 1.7, marking fraudulent orders as paid, deleting genuine payment records, and writing plugin meta onto arbitrary posts. The root cause is a missing-authorization failure (CWE-862): the plugin's confirmation handling derives the payment outcome directly from client-supplied parameters rather than verifying authenticity with CamPay, so no login, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists per WPScan, but observed exploitation is not recorded (EPSS 0.17%, 5th percentile; CISA SSVC exploitation: none), and the vendor has released a fix in version 1.7.
Unauthenticated attackers can forge Mobile Money payment confirmations against WordPress sites running the CamPay Shortcode Payment Gateway plugin before 1.7, marking fraudulent orders as paid, deleting genuine payment records, and writing plugin meta onto arbitrary posts. The root cause is a missing-authorization failure (CWE-862): the plugin's confirmation handling derives the payment outcome directly from client-supplied parameters rather than verifying authenticity with CamPay, so no login, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists per WPScan, but observed exploitation is not recorded (EPSS 0.17%, 5th percentile; CISA SSVC exploitation: none), and the vendor has released a fix in version 1.7.