Site hacked- fake payment method added

Wether 2.3.0.2 (recommended) nor 3.0.2.0 is unsafe.

IF not modified, NO additional extensions installed, AND permissions set correct.
And (seen many times) NO additional scripts or tools (e.g. to access the database, download images) are installed on the same account as OpenCart is.

Final notes for all users:

(A) unfortunately some extensions - also available at the marketplace - are obfuscated (which violates the License of OpenCart)!
Nobody will know what these extensions will really do in the background.
Which means, that every user should have an eye on those extensions he want to install.
And if ionCube is a requirement - hands off!

(B) some users may think that extensions, available on many obscure places and offered for free, are secure.
This is not true, in many cases those extensions are manipulated.