CVE-2026-33661

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the "verifywechatsign" function in "src/Functions.php" unconditionally skips all signature verification when the PSR-7 request reports "localhost" as the host. An attacker can exploi...