CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Shiv Prakash Tiwari WP Service Payment Form With Authorize.net wp-service-payment-form-with-authorizenet allows Reflected XSS.This issue affects WP Service Payment Form With Authorize.net: from n/a through <= 2.6.0.
Explanation of Vulnerability in Simple Terms
WP Service Payment Form With Authorize.net versions up to 2.6.0 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the payment form without their knowledge. The vulnerability affects the plugin's administrative functions and can lead to unauthorized changes to payment settings or form configuration.
What an attacker can do
Trick a logged-in admin into visiting a malicious page that performs unwanted actions on the payment form.
Potential impact on your site
An attacker could modify payment form settings, authorize.net configuration, or other plugin settings if an admin visits a malicious link.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special privileges required to craft the attack.
Key dates
External resources
Related vulnerabilities
