CVE-2024-8860

The CVE-2024-8860 case concerns the WordPress Tourfic plugin (versions up to and including 2.14.5). The vulnerability arises from missing capability checks in multiple functions (tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the indexonUpdateStatus function in Orders.php, which does not check for the permissions of the user before modifying an order. Remediation Upgrade tastyigniter/tastyigniter to version 4.0.0-beta.1 or higher...

PT-2025-1934 · WordPress · Shopping Cart & Ecommerce Store

Name of the Vulnerable Software and Affected Versions: The Shopping Cart & eCommerce Store plugin for WordPress versions up to, and including, 5.7.8 Description: The issue is related to a missing capability check on the webhook function, allowing unauthenticated attackers to modify order statuses...

PT-2024-15707 · WordPress · Duitku Payment Gateway

Name of the Vulnerable Software and Affected Versions: Duitku Payment Gateway plugin for WordPress versions up to, and including, 2.11.4 Description: The issue is related to a missing capability check on the check duitku response function, allowing unauthenticated attackers to modify data...

GHSA-6PQ6-CRW9-522H Cezerin Unauthorized Acces

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

Cezerin Unauthorized Acces

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

CVE-2019-18608

CVE-2019-18608 affects Cezerin v0.33.0, where internal attributes can be overwritten during order processing, allowing a malicious user to modify an order (e.g., payment status or shipping fee) by injecting extra attributes in user input via PUT /ajax/cart during checkout. The issue stems from ge...