CVE-2019-14978

Vulnerability

The WooCommerce PayU India Payment Gateway plugin version 2.1.1 for WordPress contains a parameter tampering vulnerability in the /payu/icpcheckout/ endpoint. The purchaseQuantity=1 parameter is not properly validated, allowing an attacker to modify the quantity value to manipulate the total price during checkout.

Exploitation

An attacker can exploit this by intercepting the checkout request and altering the purchaseQuantity parameter to a lower value, thereby reducing the total cost of the item. No authentication is required beyond being able to initiate a checkout session.

Impact

Successful exploitation allows an attacker to purchase items for a lower price than intended, resulting in financial loss for the merchant. The integrity of the transaction is compromised.

Mitigation

The vendor has not released a patched version as of the publication date (2019-08-29). Users should consider disabling the plugin or implementing additional server-side validation of the purchase quantity parameter until a fix is available.