CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Digages Direct Payments WP direct-payments-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Direct Payments WP: from n/a through <= 1.3.2.
Explanation of Vulnerability in Simple Terms
Direct Payments WP versions 1.3.2 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify payment data they should not access. An attacker with a basic user account can alter transaction records or payment settings without administrative approval. This affects the integrity of payment records but does not expose sensitive data or disrupt service availability.
What an attacker can do
Modify payment records or settings with a low-privilege user account.
Potential impact on your site
Payment data integrity is at risk; unauthorized users can alter transaction records or payment configuration.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
