CVE-2024-1718CWE-345

Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update

Medium · published June 4, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
9.3
In the wild
Unconfirmed
What it is

The Claudio Sanches – Checkout Cielo for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient payment validation in the update_order_status() function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the status of orders to paid bypassing payment.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.3th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2024-06-04T05:32Z
EPSS history
Timeline
  • 04 JUN 05:32Z
    Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update
    cvelistv5