Payment Gateway for Idram < 2.1.6 - Unauthenticated Arbitrary Order Status Manipulation

The Payment Gateway for Idram plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to 2.1.6. This is due to missing validation that the merchant secret key and receiving account are non-empty before accepting and verifying payment notification checksums, allowing an empty-string-based HMAC to be trivially reproduced, and absence of authentication on the failure webhook endpoint. This makes it possible for unauthenticated attackers to mark arbitrary orders as paid by forging a valid payment notification checksum, and force arbitrary orders into a failed state without any authentication.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Payment Gateway for Idram 2.1.6 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts