WordPress CVEs

Description

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

Affected WordPress components

• WooPayments: Integrated WooCommerce Payments Plugin · woocommerce-payments
  Confirmed match Active
  Version Fixed version 5.6.2
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a WooCommerce Payments WordPress Plugin — Version Fixed version 5.6.2
• automattic woocommerce_payments — From 4.8.0 (including) to 4.8.2 (excluding)
• automattic woocommerce_payments — From 5.0.0 (including) to 5.0.4 (excluding)
• automattic woocommerce_payments — From 5.1.0 (including) to 5.1.3 (excluding)
• automattic woocommerce_payments — From 5.2.0 (including) to 5.2.2 (excluding)
• automattic woocommerce_payments — From 5.5.0 (including) to 5.5.2 (excluding)
• automattic woopayments — From 5.6.0 (including) to 5.6.2 (excluding)
• automattic woopayments — Version 4.9.0
• automattic woopayments — Version 5.3.0
• automattic woopayments — Version 5.4.0

References

• developer.woocommerce.com https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/ Vendor Advisory
• www.rcesecurity.com https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/
• nvd.nist.gov Official NVD record