CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update EAN numbers for orders.
Explanation of Vulnerability in Simple Terms
The WooCommerce EAN Payment Gateway plugin before version 6.1.0 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify payment gateway settings or data without proper permission verification. This allows unauthorized changes to payment configuration that could affect transaction processing or site functionality.
What an attacker can do
Modify payment gateway settings or data without proper authorization.
Potential impact on your site
Unauthorized users could alter payment gateway configuration, potentially disrupting transactions or exposing payment data.
Conditions required to exploit
Attacker must be logged in with a low-privilege account (e.g., subscriber or customer).
Key dates
External resources
Related vulnerabilities
