CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9.
Explanation of Vulnerability in Simple Terms
The Laybuy Payment Extension for WooCommerce through version 5.3.9 lacks proper authorization checks on certain functions. An authenticated user with low privileges can modify payment-related data or settings they should not have access to. The vulnerability requires a valid WooCommerce user account but does not require administrator rights. Update to a version newer than 5.3.9 to resolve this issue.
What an attacker can do
Modify payment settings or data without proper authorization as a low-privilege authenticated user.
Potential impact on your site
Unauthorized users could alter payment configuration, potentially disrupting transactions or exposing payment data.
Conditions required to exploit
Attacker must have a valid WooCommerce user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
