Phonepe Payment Solutions
Monthly
Payment authentication bypass in the PhonePe Payment Solutions WordPress/WooCommerce plugin before 3.1.0 lets unauthenticated attackers forge payment-success callbacks and mark unpaid orders as paid. Because sites set up through the current onboarding flow have an empty callback-validation secret, the expected signature collapses to an unkeyed hash of the request body that anyone can reproduce. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.14%) and there is no public exploit identified as being used in the wild.
Payment authentication bypass in the PhonePe Payment Solutions WordPress/WooCommerce plugin before 3.1.0 lets unauthenticated attackers forge payment-success callbacks and mark unpaid orders as paid. Because sites set up through the current onboarding flow have an empty callback-validation secret, the expected signature collapses to an unkeyed hash of the request body that anyone can reproduce. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.14%) and there is no public exploit identified as being used in the wild.