CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.
Explanation of Vulnerability in Simple Terms
WooPayments versions up to 6.9.2 contain an authorization flaw that allows attackers to access sensitive payment information without authentication. The vulnerability requires specific network conditions to exploit but does not require user interaction. Sensitive data such as payment details or transaction records may be exposed. Update to a version newer than 6.9.2 to resolve this issue.
What an attacker can do
Read sensitive payment information or transaction data without logging in.
Potential impact on your site
Customer payment data and transaction records may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access to the site; specific conditions must be met to trigger the vulnerability.
Key dates
External resources
Related vulnerabilities
