9.8

CVE-2023-28121

WooCommerce Payments 4.8.0 - 5.6.1 Authentication Bypass and Privilege Escalation

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
Mögliche Gegenmaßnahme
WooPayments: Integrated WooCommerce Payments: Update to version 5.6.2, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Automattic ≫ Woocommerce Payments SwPlatform wordpress Version >= 4.8.0 < 4.8.2
Automattic ≫ Woocommerce Payments SwPlatform wordpress Version >= 5.0.0 < 5.0.4
Automattic ≫ Woocommerce Payments SwPlatform wordpress Version >= 5.1.0 < 5.1.3
Automattic ≫ Woocommerce Payments SwPlatform wordpress Version >= 5.2.0 < 5.2.2
Automattic ≫ Woocommerce Payments SwPlatform wordpress Version >= 5.5.0 < 5.5.2
Automattic ≫ Woopayments SwPlatform wordpress Version >= 5.6.0 < 5.6.2
Automattic ≫ Woopayments Version 4.9.0 SwPlatform wordpress
Automattic ≫ Woopayments Version 5.3.0 SwPlatform wordpress
Automattic ≫ Woopayments Version 5.4.0 SwPlatform wordpress
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WooPayments: Integrated WooCommerce Payments
Version 4.8.0-5.6.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 86.51% 0.997
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/
Vendor Advisory
https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/
https://www.wordfence.com/threat-intel/vulnerabilities/id/41cf57ff-421d-4db2-894f-17f2c4d4b9ed
Third Party Advisory