Sadad Qa Payment
Monthly
Unauthenticated attackers can forge a valid payment confirmation and mark store orders as paid without any payment in the Sadad QA Payment WordPress plugin through version 1.28, because the authenticity check on incoming payment notifications is keyed on a merchant secret that is empty by default while the remaining signed data is attacker-controlled. Scored CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), the flaw is exploitable against default installations with a reachable confirmation callback, but a deployment where the operator has configured a non-empty merchant secret breaks the forgery precondition. A public PoC reference exists (a WPScan vulnerability entry); it is not verified as working exploit code, and the vuln.today priority label is 'this_month' - a moderate-severity integrity issue rather than a top-tier emergency.
Unauthenticated attackers can forge a valid payment confirmation and mark store orders as paid without any payment in the Sadad QA Payment WordPress plugin through version 1.28, because the authenticity check on incoming payment notifications is keyed on a merchant secret that is empty by default while the remaining signed data is attacker-controlled. Scored CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), the flaw is exploitable against default installations with a reachable confirmation callback, but a deployment where the operator has configured a non-empty merchant secret breaks the forgery precondition. A public PoC reference exists (a WPScan vulnerability entry); it is not verified as working exploit code, and the vuln.today priority label is 'this_month' - a moderate-severity integrity issue rather than a top-tier emergency.