Lucene search

[email protected]CVE-2023-28121

HistoryApr 12, 2023 - 9:15 p.m.

CVE-2023-28121

2023-04-1221:15:28

CWE-287

[email protected]

web.nvd.nist.gov

106

woocommerce

payments

wordpress

cve-2023-28121

security

vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.924 High

EPSS

Percentile

99.0%

JSON

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

Affected configurations

NVD

Node

automatticwoocommerce_paymentsRange4.8.0–4.8.2wordpress

automatticwoocommerce_paymentsRange5.0.0–5.0.4wordpress

automatticwoocommerce_paymentsRange5.1.0–5.1.3wordpress

automatticwoocommerce_paymentsRange5.2.0–5.2.2wordpress

automatticwoocommerce_paymentsRange5.5.0–5.5.2wordpress

automatticwoopaymentsRange5.6.0–5.6.2wordpress

automatticwoopaymentsMatch4.9.0wordpress

automatticwoopaymentsMatch5.3.0wordpress

automatticwoopaymentsMatch5.4.0wordpress

CPENameOperatorVersion
automattic:woocommerce_paymentsautomattic woocommerce paymentslt4.8.2
automattic:woocommerce_paymentsautomattic woocommerce paymentslt5.0.4
automattic:woocommerce_paymentsautomattic woocommerce paymentslt5.1.3
automattic:woocommerce_paymentsautomattic woocommerce paymentslt5.2.2
automattic:woocommerce_paymentsautomattic woocommerce paymentslt5.5.2
automattic:woopaymentsautomattic woopaymentslt5.6.2
automattic:woopaymentsautomattic woopaymentseq4.9.0
automattic:woopaymentsautomattic woopaymentseq5.3.0
automattic:woopaymentsautomattic woopaymentseq5.4.0

CPE	Name	Operator	Version
automattic:woocommerce_payments	automattic woocommerce payments	lt	4.8.2
automattic:woocommerce_payments	automattic woocommerce payments	lt	5.0.4
automattic:woocommerce_payments	automattic woocommerce payments	lt	5.1.3
automattic:woocommerce_payments	automattic woocommerce payments	lt	5.2.2
automattic:woocommerce_payments	automattic woocommerce payments	lt	5.5.2
automattic:woopayments	automattic woopayments	lt	5.6.2
automattic:woopayments	automattic woopayments	eq	4.9.0
automattic:woopayments	automattic woopayments	eq	5.3.0
automattic:woopayments	automattic woopayments	eq	5.4.0

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "WooCommerce Payments WordPress Plugin",
    "versions": [
      {
        "version": "Fixed version 5.6.2",
        "status": "affected"
      }
    ]
  }
]