Chikkili Google Pay India For Woocommerce
Monthly
Unauthenticated order fraud in the Chikkili- Google Pay India for WooCommerce WordPress plugin through version 1.0.6 allows remote attackers to mark arbitrary WooCommerce orders as paid without any payment being made, because the plugin accepts payment notifications without verifying that they originated from the payment provider. The flaw is confined to sites that have installed and activated this plugin alongside WooCommerce and the Google Pay India payment method; impact is integrity-only (fraudulent paid status), with no confidentiality or availability effect and no code execution. No confirmed working exploit code is available - only a public reference that has not been verified as working exploit code - and EPSS is low at 0.14% (3rd percentile), consistent with a moderate business-logic issue rather than a top-priority emergency.
Unauthenticated order fraud in the Chikkili- Google Pay India for WooCommerce WordPress plugin through version 1.0.6 allows remote attackers to mark arbitrary WooCommerce orders as paid without any payment being made, because the plugin accepts payment notifications without verifying that they originated from the payment provider. The flaw is confined to sites that have installed and activated this plugin alongside WooCommerce and the Google Pay India payment method; impact is integrity-only (fraudulent paid status), with no confidentiality or availability effect and no code execution. No confirmed working exploit code is available - only a public reference that has not been verified as working exploit code - and EPSS is low at 0.14% (3rd percentile), consistent with a moderate business-logic issue rather than a top-priority emergency.