Unauthorized Modification of Data Due to Missing Capability Check in WP EasyPay's Square for WordPress Plugin

CVE-2024-5861

6.5MEDIUM

Key Information

Vendor: WPexpertsio
Status: WP Easypay – Square For WordPress
Vendor: CVE Published:; 24 July 2024

Summary

The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.

Affected Version(s)

WP EasyPay – Square for WordPress <= 4.2.3

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Jul 24, 2024
Disclosed
Jul 23, 2024
Vulnerability Reserved.
Jun 11, 2024

Collectors

NVD DatabaseMitre Database

Credit

Lucio Sá