Skip to content

WooCLINK v1.0.8 - Security fix

Latest
Latest

Choose a tag to compare

View all tags
@WoompaLoompa WoompaLoompa released this 26 Jul 10:03
v1.0.8
6f185bf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patches unauthenticated order payment bypass (Broken Access Control)

Changes

  • Replaced generic nonces with per-order nonces for all 4 AJAX handlers (, , , )
  • Added order status verification to mark_paid (must be pending/on-hold)
  • Added invoice existence check to mark_paid (invoice must be generated first)
  • Added ownership checks for logged-in users on confirm_payment, mark_paid, and save_ndebit

Upgrade notice

All sites should update immediately. This fixes an unauthenticated order payment bypass vulnerability.

Assets 3
Loading