Elegro Crypto Payment
Monthly
Unauthenticated attackers can forge payment-notification callbacks to the elegro Crypto Payment WordPress plugin (versions through 1.0.1) and arbitrarily change the status of orders on any installation where the shared secret has been left at its default empty value. No credentials, user interaction, or special network position are required against a vulnerable default-config site, and publicly available exploit code exists; however, the attack is fully neutralized once an administrator sets a non-empty shared secret, so only sites that never completed that configuration step are exposed. The independently assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) limits impact to integrity of order/payment state, with no confidentiality or availability effect, making this a moderate, conditional risk.
Unauthenticated attackers can forge payment-notification callbacks to the elegro Crypto Payment WordPress plugin (versions through 1.0.1) and arbitrarily change the status of orders on any installation where the shared secret has been left at its default empty value. No credentials, user interaction, or special network position are required against a vulnerable default-config site, and publicly available exploit code exists; however, the attack is fully neutralized once an administrator sets a non-empty shared secret, so only sites that never completed that configuration step are exposed. The independently assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) limits impact to integrity of order/payment state, with no confidentiality or availability effect, making this a moderate, conditional risk.