CERT24GHSA-qxp3-7pvj-q7qx: Authentication weakness in the Payex Payment Gateway for WooCommerce WordPress pluginLoading data…
CERT24Threat Observatory
Period

GHSA-qxp3-7pvj-q7qx: Authentication weakness in the Payex Payment Gateway for WooCommerce WordPress plugin

The Payex Payment Gateway for Woocommerce WordPress plugin through version 1.2.10 does not properly verify the authenticity of incoming payment notifications. Because the validation secret is empty by default, unauthenticated attackers can forge a valid payment confirmation and mark any order as paid.

← Back to intelligence

GHSA-qxp3-7pvj-q7qx: Authentication weakness in the Payex Payment Gateway for WooCommerce WordPress plugin

The Payex Payment Gateway for Woocommerce WordPress plugin through version 1.2.10 does not properly verify the authenticity of incoming payment notifications. Because the validation secret is empty by default, unauthenticated attackers can forge a valid payment confirmation and mark any order as paid.