Unauthorized Modification of Data Vulnerability in Revolut Gateway for WooCommerce Plugin

CVE-2024-8678

5.3MEDIUM

Key Information

Vendor: Revolut
Status: Revolut Gateway For WooCommerce
Vendor: CVE Published:; 25 September 2024

Summary

The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders as completed.

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Sep 25, 2024

Collectors

NVD Database