CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.
Explanation of Vulnerability in Simple Terms
WooPayments versions up to 5.9.0 expose sensitive payment and customer data to unauthenticated attackers over the network. The vulnerability allows direct access to confidential information without requiring user interaction or special conditions. No integrity or availability impact has been confirmed. Update to a version newer than 5.9.0 to resolve this issue.
What an attacker can do
Read sensitive payment and customer data without authentication.
Potential impact on your site
Customer payment details and personal information may be exposed to unauthorized parties.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
