Eurobank Woocommerce Payment Gateway
Monthly
Unauthenticated remote attackers can forge payment-confirmation callbacks against WooCommerce stores running the Eurobank WooCommerce Payment Gateway plugin through 2.1.1, marking pending orders as paid and forcing arbitrary orders into a 'failed' status. The plugin authenticates those callbacks with a shared secret that ships empty by default, so a default installation provides no barrier on the 'paid' path; only an operator who has explicitly configured a non-empty confirmation secret blocks that path, while the 'failed' status path requires no secret under any configuration. Rated CVSS 5.3 (integrity-only, PR:N/UI:N) and prioritized as a this-month remediation item; there is no CISA KEV entry and no verified working exploit code, only a public PoC reference published alongside the WPScan advisory.
Unauthenticated remote attackers can forge payment-confirmation callbacks against WooCommerce stores running the Eurobank WooCommerce Payment Gateway plugin through 2.1.1, marking pending orders as paid and forcing arbitrary orders into a 'failed' status. The plugin authenticates those callbacks with a shared secret that ships empty by default, so a default installation provides no barrier on the 'paid' path; only an operator who has explicitly configured a non-empty confirmation secret blocks that path, while the 'failed' status path requires no secret under any configuration. Rated CVSS 5.3 (integrity-only, PR:N/UI:N) and prioritized as a this-month remediation item; there is no CISA KEV entry and no verified working exploit code, only a public PoC reference published alongside the WPScan advisory.