Cryptocloud
Monthly
Unauthenticated attackers can forge CryptoCloud payment notifications to mark arbitrary WooCommerce/WordPress orders as paid or failed without any cryptocurrency payment being made, affecting plugin versions 3.0.0 through 3.0.1. The gateway callback skips its payment-notification authenticity check whenever the webhook secret is still at its empty default, so the flaw is exploitable only on default or unconfigured installs; sites where an administrator has set a non-empty secret retain the integrity check and are unaffected. Severity is moderate and integrity-only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and a public PoC reference exists at the WPScan advisory though it is not verified as working exploit code; there is no CISA KEV entry and no public exploit identified at time of analysis.
Unauthenticated attackers can forge CryptoCloud payment notifications to mark arbitrary WooCommerce/WordPress orders as paid or failed without any cryptocurrency payment being made, affecting plugin versions 3.0.0 through 3.0.1. The gateway callback skips its payment-notification authenticity check whenever the webhook secret is still at its empty default, so the flaw is exploitable only on default or unconfigured installs; sites where an administrator has set a non-empty secret retain the integrity check and are unaffected. Severity is moderate and integrity-only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and a public PoC reference exists at the WPScan advisory though it is not verified as working exploit code; there is no CISA KEV entry and no public exploit identified at time of analysis.