Visma Pay For Woocommerce
Monthly
Unauthenticated remote attackers can forge payment gateway return requests in the Visma Pay for WooCommerce WordPress plugin before 1.2.2, marking arbitrary WooCommerce orders as paid and disclosing the customer name, email address, and postal address associated with any order. The flaw is exploitable when the store has not entered a merchant secret, because the plugin validates return requests against that empty secret; fully configured stores with a non-empty secret are not described as exploitable in the same way. Publicly available exploit code exists, and the issue is rated CVSS 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Unauthenticated remote attackers can forge payment gateway return requests in the Visma Pay for WooCommerce WordPress plugin before 1.2.2, marking arbitrary WooCommerce orders as paid and disclosing the customer name, email address, and postal address associated with any order. The flaw is exploitable when the store has not entered a merchant secret, because the plugin validates return requests against that empty secret; fully configured stores with a non-empty secret are not described as exploitable in the same way. Publicly available exploit code exists, and the issue is rated CVSS 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.