WP-CVE-2023-28121

WP-CVE-2023-28121 WooCommerce Payments 5.6.2 - Escalada de Privilegios sin Autenticación Python 2.7 Invítame un café : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC ¿Cómo Usar? Instalar Python 2.7 Descargar aquí python file.py Referencia :...

CVE-2023-28121

CVE-2023-28121 usage: CVE-2023-28121.py -h -v RHOST RPORT WooCommerce Payments WordPress plugin = 5.6.1 CVE-2023-28121 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-28121 positional arguments: RHOST remote host RPORT remote port optional arguments: -h, --help show this help message an...

CVE-2023-28121

CVE-2023-28121 WooCommerce Payments: Exploit de acceso de administrador no autorizado No publicaré este primero... eso es seguro.. El PoC ya está publicado. ¡Fue creado solo con fines educativos/de investigación! ¡Úsalo bajo tu propio riesgo!...

Mass-CVE-2023-28121

CVE-2023-28121 WooCommerce Payments 5.6.2 - Escalada de privilegios no autenticada Añadir usuario administrador en masa Introducción Este script usa Python3 y utiliza threading para una mejor velocidad de proceso. El script se ha actualizado a 2 versiones. V1 es la versión antigua y V2 es la...

Mass-CVE-2023-28121-kdoec

CVE-2023-28121 Pagos de WooCommerce 5.6.2 - Escalada de privilegios no autenticada Añadir usuario administrador masivo Cómo usar Este script usa Python3. Instala los requisitos pip install -r requirements.txt Referencia https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072...

CVE-2023-28121-WordPress-Privilege-Escalation

🔐 CVE-2023-28121 — Escalada de privilegios en WordPress Explotación práctica de una vulnerabilidad crítica en WordPress usando el plugin WooCommerce Payments. 📌 Resumen La CVE-2023-28121 permite crear usuarios administradores sin autenticación vía REST API. Severidad: Crítica CVSS 9.8 Impacto:...

CVE-2023-28121

CVE-2023-28121 Notas de investigación y material auxiliar para estudiar CVE-2023-28121 en un laboratorio controlado de WordPress/WooCommerce Payments. Aviso de seguridad Utilice este material únicamente en sistemas de su propiedad o para los que tenga autorización explícita para realizar pruebas...

EUVD-2026-51699

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

CVE-2026-13329 WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

CVE-2026-13329 WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

PT-2026-67026

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

CVE-2026-13329: Improper Access Control

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

PT-2026-66996

Name of the Vulnerable Software and Affected Versions WooCommerce PayPal Payments versions prior to 3.3.3 Description An Insecure Direct Object Reference IDOR exists in the enqueue paypal insights script on order received function due to missing validation on a user-controlled key. This allows...

CVE-2026-9284

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the ppc-create-order and ppc-get-order WC-AJAX endpoints in all versions up to, and including, 4.0.1. The ppc-create-order endpoi...

CVE-2026-1710

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveupeappearanceajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to...

CVE-2026-1710 WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveupeappearanceajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to...

CVE-2026-1710 WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveupeappearanceajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to...

CVE-2026-1710

CVE-2026-1710 affects the WooPayments: Integrated WooCommerce Payments plugin for WordPress. A missing capability check in the save_upe_appearance_ajax function allows unauthenticated attackers to modify plugin settings on all versions up to and including 10.5.1. Impact is unauthenticated data mo...

CVE-2026-1710

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveupeappearanceajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to...

PT-2026-29191

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save upe appearance ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers ...