CVE-2024-2382CWE-345

Authorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass

Medium · published June 4, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
10.0
In the wild
Unconfirmed
What it is

The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.0th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2024-06-04T05:32Z
EPSS history
Timeline
  • 04 JUN 05:32Z
    Authorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass
    cvelistv5