CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders as completed.
Explanation of Vulnerability in Simple Terms
The Revolut Gateway for WooCommerce plugin through version 4.17.3 lacks proper authorization checks on certain functions. An attacker can modify payment-related data or settings without authentication. This affects WooCommerce stores using this payment gateway plugin. Update to a version newer than 4.17.3 to resolve the issue.
What an attacker can do
Modify payment settings or transaction data without logging in.
Potential impact on your site
Attackers can alter payment gateway configuration or transaction records, potentially disrupting sales or redirecting payments.
Conditions required to exploit
Network access to the WooCommerce site; no authentication required.
Key dates
External resources
Related vulnerabilities
