CVE-2023-2179 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update

2023-05-1512:15:35

WPScan

www.cve.org

cve-2023-2179

wordpress plugin

authorisation bypass

csrf

ajax

security vulnerability

order status update

low privilege user

0.001 Low

EPSS

Percentile

36.2%

JSON

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WooCommerce Order Status Change Notifier",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "1.1.0"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

wpscan.com/vulnerability/fbc56973-4225-4f44-8c38-d488e57cd551

0.001 Low

EPSS

Percentile

36.2%

JSON

Related for CVELIST:CVE-2023-2179