WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)
CVE-2023-35916
7.5HIGH
Key Information:
- Vendor
- WordPress
- Vendor
- CVE Published:
- 20 December 2023
Summary
An authorization bypass vulnerability exists in Automattic's WooPayments that allows an attacker to exploit user-controlled keys, potentially granting unauthorized access to sensitive features. This flaw affects WooPayments across various versions up to and including 5.9.0. It's crucial for users of this platform to assess their implementations and apply relevant security updates to mitigate risks.
Affected Version(s)
WooPayments – Fully Integrated Solution Built and Supported by Woo <= 5.9.0
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Rafie Muhammad (Patchstack)