Privilege Escalation Vulnerability in PayU CommercePro Plugin for WordPress

CVE-2024-12264

What is CVE-2024-12264?

The PayU CommercePro Plugin for WordPress is susceptible to a privilege escalation vulnerability due to improper identity verification in its REST API endpoints. Specifically, the /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost endpoints lack adequate checks, allowing unauthenticated attackers to manipulate the user ID and authentication cookies. This flaw enables them to gain unauthorized administrative access by creating new admin accounts, compromising the security of WordPress installations using this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References