Tiendacrypto Para Woocommerce
Monthly
Unauthenticated attackers can forge TiendaCrypto para WooCommerce payment webhooks - versions 1.0.1 through 1.2.1 - to mark arbitrary WooCommerce orders as paid, because the plugin validates the request signature against a key that is always empty. The exposure is narrow: it applies only where the webhook endpoint is reachable and the web server preserves the case of request header names, which is why it is scored 3.7 with AC:H and integrity-only impact. A public PoC reference exists (the WPScan entry); it is not verified as working exploit code, EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and the priority label is monitor.
Unauthenticated attackers can forge TiendaCrypto para WooCommerce payment webhooks - versions 1.0.1 through 1.2.1 - to mark arbitrary WooCommerce orders as paid, because the plugin validates the request signature against a key that is always empty. The exposure is narrow: it applies only where the webhook endpoint is reachable and the web server preserves the case of request header names, which is why it is scored 3.7 with AC:H and integrity-only impact. A public PoC reference exists (the WPScan entry); it is not verified as working exploit code, EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and the priority label is monitor.