Valatty

**Name of the Vulnerable Software and Affected Versions** CorvusPay WooCommerce Payment Gateway versions prior to 2.7.5 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts into pages that execute when a user accesses them. This is possible because the unauthenticated REST endpoint "POST /wp-json/corvuspay/success/" has its `permission callback` set to ` return true`. While a signature validation step is present, it only logs the result without stopping execution, allowing a malicious `approval code` to be stored in the database regardless of the signature provided. **Recommendations** Update CorvusPay WooCommerce Payment Gateway to version 2.7.5 or later. Avoid using the `approval code` parameter in the "POST /wp-json/corvuspay/success/" endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** CorvusPay WooCommerce Payment Gateway versions prior to 2.7.5 **Description** An issue exists where the `corvuspay success handler` function registers the REST endpoint `POST /wp-json/corvuspay/success/` without proper authorization checks. Although the system calls `$this->client->validate->signature()` to verify the cryptographic signature, the result is only recorded in a debug log and not used to control the flow of execution. Consequently, the process always reaches the `payment complete()` function, allowing unauthenticated attackers to mark pending orders as paid by sending a request with a forged signature. Attackers can identify target orders using the `order number` parameter, as these IDs are sequential integers. **Recommendations** Update CorvusPay WooCommerce Payment Gateway to version 2.7.5 or later. As a temporary workaround, restrict access to the `POST /wp-json/corvuspay/success/` endpoint to prevent unauthorized requests.

**Name of the Vulnerable Software and Affected Versions** CorvusPay WooCommerce Payment Gateway versions prior to 2.7.5 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to cancel any WooCommerce order processed through the CorvusPay payment method by providing an arbitrary order number to the `/wp-json/corvuspay/cancel/` REST endpoint via the `order number` parameter. **Recommendations** Update CorvusPay WooCommerce Payment Gateway to version 2.7.5 or later. As a temporary mitigation, restrict access to the `/wp-json/corvuspay/cancel/` REST endpoint.

**Name of the Vulnerable Software and Affected Versions** WP Scraper plugin for WordPress versions prior to 5.8.2 **Description** The WP Scraper plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) in versions up to and including 5.8.1. This flaw resides within the `wp scraper extract content` function and permits authenticated attackers possessing Administrator-level privileges or higher to initiate web requests to arbitrary locations from the web application. This capability can be leveraged to query and modify information from internal services. In Cloud environments, this issue enables the retrieval of metadata. **Recommendations** Update the WP Scraper plugin to version 5.8.2 or later.