The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update CVR numbers for orders.
References
Link | Resource |
---|---|
https://plugins.yanco.dk/product/woocommerce-cvr-payment-gateway/ | Product |
https://www.wordfence.com/threat-intel/vulnerabilities/id/f72ba0e2-a9c4-43b0-a01f-185554090162?source=cve | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-09-14T03:24:07.870Z
Updated: 2023-09-14T03:24:07.870Z
Reserved: 2023-09-13T15:04:01.049Z
Link: CVE-2023-4948
JSON object: View
NVD Information
Status : Modified
Published: 2023-09-14T04:15:10.457
Modified: 2023-11-07T04:23:12.883
Link: CVE-2023-4948
JSON object: View
Redhat Information
No data.
CWE
No CWE.