Ccavenue Payment Gateway For Woocommerce
Monthly
Unauthenticated attackers can forge CCAvenue payment-confirmation requests against WooCommerce stores running the CCAvenue Payment Gateway plugin through version 3.1, marking an existing or newly created order as paid without payment. The access-control weakness (CWE-284) stems from missing verification that the request originates from the provider and from a verification key derived from a value that is empty on a default install; CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only), and default installations with the callback active are exposed while stores with a populated non-empty key are not. No CISA KEV entry is present, and a public exploit reference exists but is not verified as working exploit code.
Unauthenticated attackers can forge CCAvenue payment-confirmation requests against WooCommerce stores running the CCAvenue Payment Gateway plugin through version 3.1, marking an existing or newly created order as paid without payment. The access-control weakness (CWE-284) stems from missing verification that the request originates from the provider and from a verification key derived from a value that is empty on a default install; CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only), and default installations with the callback active are exposed while stores with a populated non-empty key are not. No CISA KEV entry is present, and a public exploit reference exists but is not verified as working exploit code.