Ipospays Payment Gateway For Woocommerce
Monthly
The iPOSpays Payment Gateway for WooCommerce plugin (all versions before 1.4.7) records orders as paid without confirming that a payment actually settled, letting unauthenticated remote attackers flip any unpaid order to 'paid' and rewrite the order total. Exploitation is trivial where the gateway is enabled - no credentials, privileges, or victim interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - but impact is confined to order and payment-record integrity, with no data disclosure or availability loss, giving a base score of 5.3. Publicly available exploit code exists and the flaw was reported by WPScan; there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
The iPOSpays Payment Gateway for WooCommerce plugin (all versions before 1.4.7) records orders as paid without confirming that a payment actually settled, letting unauthenticated remote attackers flip any unpaid order to 'paid' and rewrite the order total. Exploitation is trivial where the gateway is enabled - no credentials, privileges, or victim interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - but impact is confined to order and payment-record integrity, with no data disclosure or availability loss, giving a base score of 5.3. Publicly available exploit code exists and the flaw was reported by WPScan; there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.