Slek Gateway For Woocommerce
Monthly
Slek Gateway for WooCommerce plugin version 1.0 exposes merchant API credentials (slek_key and slek_secret) to unauthenticated attackers through client-side HTML forms and plaintext GET parameters. An attacker who places an order on an affected WooCommerce store can extract the merchant's secret credentials by inspecting the HTML source or using browser developer tools on the order-pay page before JavaScript auto-submission occurs, compromising the merchant's Slek payment processing account.
Slek Gateway for WooCommerce plugin version 1.0 exposes merchant API credentials (slek_key and slek_secret) to unauthenticated attackers through client-side HTML forms and plaintext GET parameters. An attacker who places an order on an affected WooCommerce store can extract the merchant's secret credentials by inspecting the HTML source or using browser developer tools on the order-pay page before JavaScript auto-submission occurs, compromising the merchant's Slek payment processing account.