Gateway For Vantiv On Wc
Monthly
Unauthenticated attackers can mark WooCommerce orders as paid without actually paying in sites running the 'Gateway for Vantiv on WC' WordPress plugin through version 1.0.1. The plugin's hosted-payment return handler accepts return notifications without verifying their authenticity (CWE-284), yielding a low-integrity impact (CVSS 5.3, I:L) with no confidentiality or availability effect. Publicly available exploit code exists, and exploitation is limited to sites that use this specific plugin as their payment gateway and expose the return handler.
Unauthenticated attackers can mark WooCommerce orders as paid without actually paying in sites running the 'Gateway for Vantiv on WC' WordPress plugin through version 1.0.1. The plugin's hosted-payment return handler accepts return notifications without verifying their authenticity (CWE-284), yielding a low-integrity impact (CVSS 5.3, I:L) with no confidentiality or availability effect. Publicly available exploit code exists, and exploitation is limited to sites that use this specific plugin as their payment gateway and expose the return handler.