Payment Gateway via Valitor for WooCommerce < 1.9.41 - Unauthenticated Payment Bypass via a Shipped Default Verification Code

Description

The plugin does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.