Andrés Cruciani

**Name of the Vulnerable Software and Affected Versions** Advanced Product Fields (Product Addons) for WooCommerce versions prior to 1.6.22 **Description** Improper Input Validation occurs due to a logic flaw in the `validate cart data()` function. This allows unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, resulting in the acquisition of products for a fraction of the intended total. **Recommendations** Update Advanced Product Fields (Product Addons) for WooCommerce to version 1.6.22 or later.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.4.1 **Description** Improper input validation in the Stripe Connect payment processor allows unauthenticated attackers to pay an arbitrary amount. This occurs because the plugin accepts a client-supplied PaymentIntent ID, enabling the use of a previously succeeded PaymentIntent token to bypass correct payment amounts. **Recommendations** Update the plugin to a version newer than 5.4.0.

Name of the Vulnerable Software and Affected Versions The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More versions through 1.8.9.7 Description The Charitable – Donation Plugin for WordPress is affected by a flaw due to missing cryptographic verification of incoming Stripe webhook events. This allows attackers to forge `payment intent.succeeded` webhook payloads and falsely mark pending donations as completed without a valid payment. Recommendations Update to a version newer than 1.8.9.7.

**Name of the Vulnerable Software and Affected Versions** Formidable Forms plugin for WordPress versions up to and including 6.28 **Description** The Formidable Forms plugin for WordPress is susceptible to a payment integrity issue. This occurs because the Stripe Link return handler, `handle one time stripe link return url`, confirms payment completion based only on the Stripe PaymentIntent status, without verifying the charged amount against the expected payment. Additionally, the `verify intent()` function only checks client secret ownership, failing to link intents to specific forms or actions. This allows unauthenticated attackers to potentially reuse a PaymentIntent from a completed low-value payment to falsely mark a high-value payment as complete, bypassing payment for goods or services. **Recommendations** Update Formidable Forms plugin to a version beyond 6.28.