CVE-2025-14463 Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation

The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to the plugin exposing a public AJAX endpoint wppaypalcheckoutajaxprocessorder that processes checkout results without any authentication or...

Microsoft Threatens Discoverer of 'Cash Back' Loophole in Bing

The security glitch, which is linked to a “cash back” system operated by Bing, potentially leaves users and retailers exposed to fake transactions. But despite an outcry online over the existence of the loophole, the world’s largest company has responded to the issue by threatening legal action...