CVE-2024-8678 Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update

The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders a...

CVE-2024-8319

The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tforderstatusemailresendfunction, tfvisitordetailseditfunction, tfcheckinoutdetailseditfunction,...

WordPress Payflex Payment Gateway plugin <= 2.5.0 - Missing Authorization to Order Status Update vulnerability

Missing Authorization to Order Status Update vulnerability discovered by Francesco Carlucci in WordPress Plugin Payflex Payment Gateway versions = 2.5.0...

PT-2024-15695

Name of the Vulnerable Software and Affected Versions Payflex Payment Gateway plugin for WordPress versions up to, and including, 2.5.0 Description The issue is related to a missing capability check on the payment callback function, allowing unauthenticated attackers to update the status of order...

Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update

Description The Claudio Sanches – Checkout Cielo for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient payment validation in the updateorderstatus function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated...

PT-2024-18248

Name of the Vulnerable Software and Affected Versions Claudio Sanches – Checkout Cielo for WooCommerce plugin for WordPress versions up to, and including, 1.1.0 Description The issue is related to insufficient payment validation in the update order status function, allowing unauthenticated...

CVE-2024-0631

The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkduitkuresponse function in all versions up to, and including, 2.11.4. This makes it possible for unauthenticated attackers to change the payment status ...

EventPrime – Events Calendar, Bookings and Tickets < 3.4.3 - Unauthenticated Booking Payment Bypass

Description The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for...

Broken Access Control order API in Shopware

Impact In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order stat...

GHSA-3867-JC5C-66QF Broken Access Control order API in Shopware

Impact In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order stat...

Broken Access Control

shopware/core and shopware/platform are vulnerable to Broken Access Control. The vulnerability is due to a insufficiency in verifying user authorizations for actions that modify the payment, delivery, and/or order status resulting in users lacking write permissions for orders being able to change...

CVE-2024-22407 Broken Access Control order API in Shopware

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for order...

CVE-2023-48926

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

Code injection

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The program offers multiple payment methods, SMS alerts and product image zoom. A security vulnerability exists in PrestaShop Advanced Loyalty Program: Loyalty Points prior to v2.3.4, which originated fro...

Shopware Access Control Error Vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware. An access control error vulnerability exists in Shopware versions 6.5.7.3 and earlier, which stems from the presence of an access control error vulnerability that allows a user who lacks order write privilege...

CVE-2023-48926

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

CVE-2023-48926

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

CVE-2023-48926: Missing Authorization

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

PT-2024-13662

Name of the Vulnerable Software and Affected Versions 202 ecommerce Advanced Loyalty Program: Loyalty Points versions prior to 2.3.4 for PrestaShop Description The issue allows unauthenticated attackers to arbitrarily change an order status. Recommendations For versions prior to 2.3.4, update to...