CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0. This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs.
Explanation of Vulnerability in Simple Terms
The Oceanpayment CreditCard Gateway versions 6.0 and earlier contain a missing authentication control that allows an attacker to modify data without credentials. The vulnerability requires only network access and no user interaction. An attacker can alter payment or transaction information, potentially affecting the integrity of financial records processed through the gateway.
What an attacker can do
Modify payment or transaction data without authentication.
Potential impact on your site
Payment records and transaction data can be altered by unauthorized parties, risking financial fraud and data integrity.
Conditions required to exploit
Network access to the vulnerable gateway; no authentication or user interaction required.
Key dates
External resources
