CVE-2020-11497: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2020-11497) affects the WordPress NAB Transact WooCommerce Plugin versions below 2.1.2. Discovered by Jack Misiura from The Missing Link and disclosed on August 20, 2020, this security flaw allows attackers to bypass the payment system in the WooCommerce NAB Transact plugin (SecLists, WPScan).

The vulnerability stems from the plugin's failure to validate the origin of payment processor status requests. The flaw allows attackers to mark orders as fully paid by issuing a specially crafted GET request during the ordering workflow. The attack involves manipulating parameters such as order numbers, order codes, and transaction IDs in the request URL to bypass the payment process (Missing Link, SecLists).

Successful exploitation of this vulnerability allows attackers to mark any pending orders as fully paid and introduce arbitrary transaction numbers into the payment records without actually completing the payment process. This could result in financial losses for merchants using the affected plugin (Missing Link).

The vulnerability was patched in version 2.1.2 of the NAB Transact WooCommerce plugin. Site administrators are strongly recommended to update to this version immediately to prevent potential exploitation (WPScan).