Cardinity Payment Gateway For Woocommerce
Monthly
Unauthenticated attackers can forge payment notifications against WordPress/WooCommerce stores running the Cardinity Payment Gateway plugin before version 3.4.2, because the plugin ships with an empty notification signing secret and fails to properly validate the authenticity of incoming callbacks. By sending a crafted 'approved payment' (or 'failed') notification to the plugin's payment-callback handler, a remote attacker with no credentials and no user interaction can mark arbitrary orders as paid - payment fraud - or force legitimate orders into a failed state. The vulnerability is exploitable against default installations, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation in the wild; impact is bounded to order-status manipulation rather than code execution, data theft, or service disruption.
Unauthenticated attackers can forge payment notifications against WordPress/WooCommerce stores running the Cardinity Payment Gateway plugin before version 3.4.2, because the plugin ships with an empty notification signing secret and fails to properly validate the authenticity of incoming callbacks. By sending a crafted 'approved payment' (or 'failed') notification to the plugin's payment-callback handler, a remote attacker with no credentials and no user interaction can mark arbitrary orders as paid - payment fraud - or force legitimate orders into a failed state. The vulnerability is exploitable against default installations, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation in the wild; impact is bounded to order-status manipulation rather than code execution, data theft, or service disruption.