Paydunya Woocommerce Payment Gateway
Monthly
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 lets unauthenticated remote attackers mark arbitrary WooCommerce orders as paid and completed, because incoming payment notifications are not checked for authenticity and, while the gateway remains unconfigured, are validated with a value derived from an empty secret that anyone can compute. Sites running WordPress with WooCommerce and this plugin active are exposed with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3), and the impact is confined to order-state fraud rather than data exposure or outage. There is no CISA KEV entry and no confirmed exploitation; a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.11% (1st percentile).
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 lets unauthenticated remote attackers mark arbitrary WooCommerce orders as paid and completed, because incoming payment notifications are not checked for authenticity and, while the gateway remains unconfigured, are validated with a value derived from an empty secret that anyone can compute. Sites running WordPress with WooCommerce and this plugin active are exposed with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3), and the impact is confined to order-state fraud rather than data exposure or outage. There is no CISA KEV entry and no confirmed exploitation; a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.11% (1st percentile).