Deema Payment Gateway
Monthly
Unauthenticated attackers can manipulate order states in the Deema Payment Gateway WordPress plugin (versions through 1.1.2) by exploiting a missing payment verification step in the hosted-checkout return handler, causing orders to be marked as paid without any actual payment. The plugin fails to confirm transaction status or amount with the payment provider, and publicly available exploit code exists. With a CVSS score of 5.3 (MEDIUM), the impact is limited to integrity of order data, with no confidentiality or availability effects.
Unauthenticated attackers can mark unpaid orders as paid or cancel/refund existing orders on WordPress sites running the Deema Payment Gateway plugin through version 1.1.2, because the plugin fails to verify the authenticity of incoming payment provider notifications and ships with that verification disabled by default. The flaw is remotely exploitable without authentication (CVSS 5.3, CWE-287) and affects order integrity only, with no server compromise or data disclosure. Publicly available exploit code exists, but CISA SSVC indicates no observed exploitation; this is a genuine but moderate-priority issue rather than a critical emergency, and it should be patched or mitigated promptly.
Unauthenticated attackers can manipulate order states in the Deema Payment Gateway WordPress plugin (versions through 1.1.2) by exploiting a missing payment verification step in the hosted-checkout return handler, causing orders to be marked as paid without any actual payment. The plugin fails to confirm transaction status or amount with the payment provider, and publicly available exploit code exists. With a CVSS score of 5.3 (MEDIUM), the impact is limited to integrity of order data, with no confidentiality or availability effects.
Unauthenticated attackers can mark unpaid orders as paid or cancel/refund existing orders on WordPress sites running the Deema Payment Gateway plugin through version 1.1.2, because the plugin fails to verify the authenticity of incoming payment provider notifications and ships with that verification disabled by default. The flaw is remotely exploitable without authentication (CVSS 5.3, CWE-287) and affects order integrity only, with no server compromise or data disclosure. Publicly available exploit code exists, but CISA SSVC indicates no observed exploitation; this is a genuine but moderate-priority issue rather than a critical emergency, and it should be patched or mitigated promptly.