The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update EAN numbers for orders.
References
Link | Resource |
---|---|
https://plugins.yanco.dk/product/woocommerce-ean-payment-gateway/ | Product |
https://www.wordfence.com/threat-intel/vulnerabilities/id/2760b183-3c15-4f0e-b72f-7c0333f9d4b6?source=cve | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-10-20T06:35:12.814Z
Updated: 2023-10-20T06:35:12.814Z
Reserved: 2023-09-13T15:03:45.844Z
Link: CVE-2023-4947
JSON object: View
NVD Information
Status : Modified
Published: 2023-10-20T07:15:16.740
Modified: 2023-11-07T04:23:12.703
Link: CVE-2023-4947
JSON object: View
Redhat Information
No data.
CWE