CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment.
Explanation of Vulnerability in Simple Terms
The Authorize.net Payment Gateway For WooCommerce plugin through version 8.0 contains an integrity vulnerability that allows unauthenticated attackers to modify data via the network. No user interaction is required. The vulnerability does not affect confidentiality or availability. Site administrators should update to a version newer than 8.0 when available.
What an attacker can do
Modify data on the site without authentication.
Potential impact on your site
Attackers can alter payment gateway data or settings without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
