WordPress Plugin Vulnerabilities
Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery
Description
The plugin does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.
Proof of Concept
Affects Plugins
No known fix References
CVE
Classification
Type
ACCESS CONTROLS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-16 (about 2 days ago)
Added
2026-10-09 (about 9 days ago)
Last Updated
2026-10-09 (about 9 days ago)
