Massive Targeted Exploit Campaign Against WooCommerce Payments Underway

The Wordfence Threat Intelligence team has been monitoring an ongoing exploit campaign targeting a recently disclosed vulnerability in WooCommerce Payments, a plugin installed on over 600,000 sites. Large-scale attacks against the vulnerability, assigned CVE-2023-28121, began on Thursday, July 14...

VulnCheck KEV: CVE-2023-28121

An issue in WooCommerce Payments plugin for WordPress versions 5.6.1 and lower allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of...

PT-2023-25711 · Unknown · Nesote Inout Blockchain Easypayments

Name of the Vulnerable Software and Affected Versions: Nesote Inout Blockchain EasyPayments version 1.0 Description: A critical issue was found in the POST Parameter Handler component of the /index.php/payment/getcoinaddress file. The manipulation of the coinid argument leads to sql injection,...

Metasploit Weekly Wrap-Up

Authentication bypass in Wordpress Plugin WooCommerce Payments This week's Metasploit release includes a module for CVE-2023-28121 by h00die. This module can be used against any wordpress instance that uses WooCommerce payments 5.6.1. This module exploits an auth by-pass vulnerability in the...

Use After Free

Google Chrome is vulnerable to Use After Free. The vulnerability exists in the autofill payments of the library, which allows an attacker to cause heap corruptions via a maliciously crafted HTML page...

CVE-2023-35917

Cross-Site Request Forgery CSRF vulnerability in WooCommerce PayPal Payments plugin = 2.0.4 versions...

CVE-2023-35917

Cross-Site Request Forgery CSRF vulnerability in WooCommerce PayPal Payments plugin = 2.0.4 versions...

CVE-2023-35917 WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WooCommerce PayPal Payments plugin = 2.0.4 versions...

CVE-2023-35917

CVE-2023-35917 concerns a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin WooCommerce PayPal Payments (versions ≤ 2.0.4). The issue arises from missing CSRF protections when updating merchant ID details, allowing an attacker to induce unwanted actions on behalf of an authe...

WordPress Plugin WooCommerce PayPal Payments 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2023-25382 · WordPress · Woocommerce Paypal Payments

Name of the Vulnerable Software and Affected Versions: WooCommerce PayPal Payments plugin versions = 2.0.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

WooCommerce Payments < 4.5.1 - Intent Parameter Tampering

The plugin allows customer to complete an order on a merchant’s site without paying for it...

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce Payments Type Plugin Vulnerable versions = 5.9.0 Fixed in 5.9.1 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-35916 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID e4c9d390a631 Credits Rafie...

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection

Software WooCommerce Payments Type Plugin Vulnerable versions = 5.9.0 Fixed in 5.9.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-35915 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID fc4b292023c2 Credits Rafie Muhammad Patchstack Required privilege...

WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce PayPal Payments Type Plugin Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-35917 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 826365482c2a Credits Rafie...

Google Chrome Autofill payments code execution vulnerability

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome Autofill payments, which can be exploited by an attacker to execute arbitrary code on a system or cause an application to crash...

Fedora 38 : chromium (2023-5f35718d4c)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f35718d4c advisory. Update to 114.0.5735.133. Fixes the following security issues: CVE-2023-3214, CVE-2023-3215, CVE-2023-3215, CVE-2023-3217, Tenable has extracted the...

Chromium: CVE-2023-3214 Use after free in Autofill payments

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

SUSE CVE-2023-3214

Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

The vulnerability of the Autofill Payments function in Google Chrome browser allows for the insertion of arbitrary codes.

The vulnerability of Google Chrome’s Autofill Payments function is related to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...