Sumit Payment Gateway For Woocommerce
Monthly
Unauthenticated remote attackers can mark pending WooCommerce orders as paid without completing payment by abusing the SUMIT Payment Gateway for WooCommerce plugin before version 4.0.0, which accepts payment notifications without validating them against the SUMIT payment provider. The vulnerability is network-reachable with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) and is confined to falsifying order payment status, i.e. financial fraud rather than site compromise; publicly available exploit code exists, though there is no confirmation of active exploitation (not in CISA KEV). Risk is bounded mainly by the niche adoption of this specific gateway and by the fact that the integrity impact is limited to order state.
Unauthenticated remote attackers can mark pending WooCommerce orders as paid without completing payment by abusing the SUMIT Payment Gateway for WooCommerce plugin before version 4.0.0, which accepts payment notifications without validating them against the SUMIT payment provider. The vulnerability is network-reachable with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) and is confined to falsifying order payment status, i.e. financial fraud rather than site compromise; publicly available exploit code exists, though there is no confirmation of active exploitation (not in CISA KEV). Risk is bounded mainly by the niche adoption of this specific gateway and by the fact that the integrity impact is limited to order state.