CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HitPay Payment Solutions Pte Ltd HitPay Payment Gateway for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects HitPay Payment Gateway for WooCommerce: from n/a through 4.1.3.
Explanation of Vulnerability in Simple Terms
The HitPay Payment Gateway for WooCommerce up to version 4.1.3 exposes sensitive information to unauthenticated attackers over the network. An attacker can retrieve confidential data without needing valid credentials or user interaction. This affects any WooCommerce store using the vulnerable plugin version.
What an attacker can do
Read sensitive information from the payment gateway without authentication.
Potential impact on your site
Customer or payment data may be exposed to anyone on the internet who discovers the vulnerable endpoint.
Conditions required to exploit
Network access to the affected WooCommerce site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
