WordPress WooCommerce Clover Payment Gateway Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software WooCommerce Clover Payment Gateway Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0626 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 06c0aefba99a Credits Francesco...

WooCommerce Clover Payment Gateway < 1.3.2 - Missing Authorization via callback_handler

Description The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callbackhandler function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to mark...

Design/Logic Flaw

The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkduitkuresponse function in all versions up to, and including, 2.11.4. This makes it possible for unauthenticated attackers to change the payment status ...

CVE-2024-0631

The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkduitkuresponse function in all versions up to, and including, 2.11.4. This makes it possible for unauthenticated attackers to change the payment status ...

CVE-2024-0631

The CVE refers to the Duitku Payment Gateway WordPress plugin (WordPress) with a vulnerable check_duitku_response function. The issue is due to a missing capability check that affects all versions up to and including 2.11.4, allowing unauthenticated attackers to modify data and set payments to fa...

WordPress Plugin Duitku Payment Gateway Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Payment Gateway for Telcell < 2.0.4 - Unauthenticated Open Redirect

Description The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue https://localhost/wp-admin/admin.php?page=wc-settings&action=redirecttelcellform&apiurl=https://www.google.com...

Payment Gateway for Telcell < 2.0.4 - Unauthenticated Open Redirect

Description The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue PoC https://localhost/wp-admin/admin.php?page=wc-settings=redirecttelcellformurl=https://www.google.com...

WordPress Duitku Payment Gateway Plugin <= 2.11.6 is vulnerable to Broken Access Control

Software Duitku Payment Gateway Type Plugin Vulnerable versions = 2.11.6 Fixed in 2.11.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0631 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 48de9cbc8e6d Credits Francesco Carlucci...

Duitku Payment Gateway < 2.11.7 - Missing Authorization via check_duitku_response

Description The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkduitkuresponse function in all versions up to, and including, 2.11.4. This makes it possible for unauthenticated attackers to change the...

CVE-2024-0610

The CVE-2024-0610 entry concerns the Piraeus Bank WooCommerce Payment Gateway for WordPress. A time-based blind SQL Injection exists in the MerchantReference parameter across all versions up to and including 1.6.5.1, caused by insufficient escaping of user input and inadequate preparation of the ...

Piraeus Bank WooCommerce Payment Gateway < 1.7.0 - Unauthenticated SQL Injection

Description The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference' parameter in all versions up to, and including, 1.6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress Stripe Payment Gateway for WooCommerce Plugin <= 3.7.9 is vulnerable to SQL Injection

Software Stripe Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 3.7.9 Fixed in 3.8.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0705 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 8c922733cce2 Credits Francesco Carlucci Requir...

CVE-2023-52218

Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8...

CVE-2023-52218

Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8...

CVE-2023-52218 WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8...

CVE-2023-52218

CVE-2023-52218 concerns the WordPress plugin WooCommerce Tranzila Gateway (versions

CVE-2023-52218 WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8...

PT-2024-14482 · Unknown · Woocommerce Tranzila Payment Gateway

Name of the Vulnerable Software and Affected Versions: WooCommerce Tranzila Payment Gateway versions 1.0.8 and earlier Description: The issue is related to the deserialization of untrusted data in the Anton Bond WooCommerce Tranzila Payment Gateway. Recommendations: For versions 1.0.8 and earlier...