The Fundiin cho WooCommerce plugin through version 3.4.0 suffers from missing authorization checks on several REST API endpoints, using a hard‑coded credential that is identical across installations. This flaw permits an attacker with no authentication to read the store’s payment gateway credentials, customer order data and to modify the gateway configuration so that funds are redirected to an unauthorized account. The same lack of input validation allows arbitrary JavaScript to be stored in a field that is rendered unescaped on the classic checkout, enabling stored XSS against unauthenticated visitors.

The vulnerability affects the Fundiin cho WooCommerce WordPress plugin, version 3.4.0 and earlier, which is used on WooCommerce‑based online stores. No vendor is explicitly listed; the affected product is the plugin itself.

Because the flaw can be exploited without authentication, the risk is high. An attacker can exfiltrate sensitive payment data, redirect sales, falsify order status and run client‑side scripts. The CVSS score is 9.1, underscoring the severity of credential disclosure and stored XSS. EPSS is not available, but the vulnerability’s characteristics warrant immediate mitigation. Currently the vulnerability is not listed in CISA’s KEV catalog, but the lack of authorization makes it a likely target for exploitation.