IDOR able to buy a plan with lesser fee
Program: Automattic
Bug Type: IDOR
Bounty: Unspecified
Date: 2022-08-24
IDOR
Summary
The researcher found a vulnerablity that let's a user pay for an order with the same amount but different currency. in the url - https://account.mailpoet.com/orders/new?p=214&cur=usd
change the cur parameter to any other currency and it shows the same amount, The security team triaged this as informative, as the platform has same price for every product in every currency by design.