Total Processing Card Payments For Woocommerce
Monthly
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).