WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)
CVE-2023-35916

7.5HIGH

Key Information:

Vendor

WordPress
Status
WooPayments – Fully Integrated Solution Built and Supported by Woo
Vendor
CVE Published:
20 December 2023

What is CVE-2023-35916?

An authorization bypass vulnerability exists in Automattic's WooPayments that allows an attacker to exploit user-controlled keys, potentially granting unauthorized access to sensitive features. This flaw affects WooPayments across various versions up to and including 5.9.0. It's crucial for users of this platform to assess their implementations and apply relevant security updates to mitigate risks.

Affected Version(s)

WooPayments – Fully Integrated Solution Built and Supported by Woo <= 5.9.0

References

https://patchstack.com/database/vulnerability/woocommerce...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.