CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

PRODSECBUG-2187: Cross-site request forgery (CSRF) in checkout cart item

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...

Code injection

An authenticated attacker in SAP E-Commerce Business-to-Consumer application, versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even...

WordPress WooCommerce Checkout Plugin < 4.3 Unauthenticated Media Deletion Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2019-11807

The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=updateattachmentwccm wccmdefaultkeysload parameter because of a nopriv registration and a lack of capabilities checks...

Design/Logic Flaw

The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=updateattachmentwccm wccmdefaultkeysload parameter because of a nopriv registration and a lack of capabilities checks...

CVE-2019-11807

The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=updateattachmentwccm wccmdefaultkeysload parameter because of a nopriv registration and a lack of capabilities checks...

CVE-2019-11807

CVE-2019-11807 affects the WordPress plugin “WooCommerce Checkout Manager” (before version 4.3). The vulnerability allows unauthenticated users to delete media via an AJAX endpoint: wp-admin/admin-ajax.php?action=update_attachment_wccm with the wccm_default_keys_load parameter, caused by an insec...

CVE-2019-11807

The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=updateattachmentwccm wccmdefaultkeysload parameter because of a nopriv registration and a lack of capabilities checks...

PT-2019-12497

Name of the Vulnerable Software and Affected Versions WooCommerce Checkout Manager plugin versions prior to 4.3 Description The issue allows media deletion due to a lack of capabilities checks and a nopriv registration. This can be exploited via the "wp-admin/admin-ajax.php?action=update attachme...

CVE-2019-11807: Unrestricted Upload of File with Dangerous Type

The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=updateattachmentwccm wccmdefaultkeysload parameter because of a nopriv registration and a lack of capabilities checks...

WordPress WooCommerce Checkout Manager Plugin Arbitrary File Upload

An Arbitrary File Upload vulnerability exists in WordPress WooCommerce Checkout Manager Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WooCommerce Checkout Manager Plugin for WordPress < 4.3 Arbitrary File Upload

The WordPress WooCommerce Checkout Manager Plugin installed on the remote host is affected by an arbitrary file upload vulnerability. An unauthenticated, remote attacker can leverage this issue to escalate privileges and execute arbitrary code on the affected host. Note that the scanner has not...

Users Urged to Update WordPress Plugin After Flaw Disclosed

UPDATE A vulnerability in a popular WordPress plugin called the WooCommerce Checkout Manager extension is potentially putting more than 60,000 websites at risk, researchers say. The WooCommerce Checkout Manager plugin allows WooCommerce users to customize and manage the fields on their checkout...

Critical Unpatched Flaw Disclosed in WordPress WooCommerce Extension

If you own an eCommerce website built on WordPress and powered by WooCommerce plugin, then beware of a new, unpatched vulnerability that has been made public and could allow attackers to compromise your online store. A WordPress security company—called "Plugin Vulnerabilities "—that recently gone...

WordPress WooCommerce Checkout Manager plugin 4.2.6 (latest) - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability found in WordPress WooCommerce Checkout Manager plugin version 4.2.6. Solution 26 April 2019 - no patched version available...

WooCommerce Checkout Manager <= 4.2.6 - Arbitrary File Upload

The Checkout Manager for WooCommerce WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

WordPress PayPal Checkout Payment Gateway 1.6.8 Parameter Tampering

Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price Date: 27.01.2019 Product Title :Woocommer...

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an ite...

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering

Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price Date: 27.01.2019 Product Title :Woocommer...