Unauthenticated Payment Bypass in Chikkili Google Pay India for WooCommerce

Executive Summary

This vulnerability is in the Chikkili Google Pay for WooCommerce plugin (version 1.0.6 or below). It allows attackers to trick the plugin into marking orders as paid without any actual payment being made. The plugin fails to verify if payment notifications come from the legitimate payment provider, enabling unauthenticated attackers to exploit this flaw.

Useful 0 Not Useful 0

Detection Guidance

Check if the Chikkili Google Pay for WooCommerce plugin version 1.0.6 or below is installed on your WordPress site. Review payment logs for suspicious orders marked as paid without corresponding transactions.

Useful 0 Not Useful 0

Impact Analysis

If you use this plugin, attackers could mark orders as paid without receiving payment, leading to financial losses. You might ship products without getting paid, or your store could show incorrect order statuses, causing confusion and potential disputes with customers.

Useful 0 Not Useful 0

Mitigation Strategies

Update the plugin to the latest version if available. Disable the plugin temporarily if no update exists. Monitor orders for unauthorized payment confirmations and verify transactions manually.

Useful 0 Not Useful 0