Paymentfor Gateway For Woocommerce
Monthly
Unauthenticated attackers can mark WooCommerce orders as paid without any payment taking place on sites running the Paymentfor Gateway for WooCommerce plugin before 1.0.6, because the plugin never verifies that an inbound payment notification actually came from the payment provider. Exploitation is simple for anyone who can reach the gateway's notification (callback/IPN) endpoint and reference an existing order - publicly available exploit code exists, and no credentials or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - but the risk is real yet bounded, since only stores that installed and enabled this specific gateway are affected. EPSS is low at 0.17% (5th percentile), there is no CISA KEV listing, and a vendor fix is available in version 1.0.6.
Unauthenticated attackers can mark WooCommerce orders as paid without any payment taking place on sites running the Paymentfor Gateway for WooCommerce plugin before 1.0.6, because the plugin never verifies that an inbound payment notification actually came from the payment provider. Exploitation is simple for anyone who can reach the gateway's notification (callback/IPN) endpoint and reference an existing order - publicly available exploit code exists, and no credentials or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - but the risk is real yet bounded, since only stores that installed and enabled this specific gateway are affected. EPSS is low at 0.17% (5th percentile), there is no CISA KEV listing, and a vendor fix is available in version 1.0.6.