The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total. This vulnerability allows attackers to manipulate order status, potentially leading to financial losses. Defenders should assess exposure and verify the p [truncated]
A Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPOSpays Gateways WC: from n/a through <= 1.3.7. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The CVE record and NVD entry provide limited information about the vulnerability, but it is clear that the vulnerabi [truncated]
