The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Call or email us to get started.