6.5
CVE-2023-2179
- EPSS 0.07%
- Veröffentlicht 15.05.2023 13:15:10
- Zuletzt bearbeitet 24.01.2025 21:15:10
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginWooCommerce Order Status Change Notifier <= 1.1.0 - Authenticated (Subscriber+) Arbitrary Order Status Update
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
Mögliche Gegenmaßnahme
WooCommerce Order Status Change Notifier: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WooCommerce Order Status Change Notifier
Version
* - 1.1.0
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Woocommerce ≫ Woocommerce Order Status Change Notifier SwPlatformwordpress Version <= 1.1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.207 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
|