Unauthorized Data Modification Vulnerability in Mollie Payment Forms & Donations Plugin
CVE-2023-7294

7.1HIGH

Key Information:

Vendor

WordPress
Status
Paytium: Mollie Payment Forms & Donations
Vendor
CVE Published:
16 October 2024

What is CVE-2023-7294?

The Paytium: Mollie payment forms & donations plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the create_mollie_profile function allows authenticated attackers with subscriber-level access to exploit this vulnerability. By doing so, they can create malicious Mollie payment profiles, potentially leading to data integrity issues and further exploitation within the application. Users of the plugin versions up to and including 4.3.7 should take immediate actions to secure their installations.

Affected Version(s)

Paytium: Mollie payment forms & donations 0 <= 4.3.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.