WordPress Plugin Vulnerabilities
TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass
Description
The plugin does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
Proof of Concept
Affects Plugins
No known fix References
CVE
Classification
Type
INSUFFICIENT CRYPTOGRAPHY
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-24 (about 2 days ago)
Added
2026-10-17 (about 9 days ago)
Last Updated
2026-10-17 (about 9 days ago)
