High · published January 10, 2026
⚡ The WooCommerce Square plugin has a sneaky flaw that lets attackers access sensitive credit card info! Think of it like a restaurant that lets anyone walk into the kitchen and grab orders, without checking who they are. This vulnerability allows attackers to request credit card information without any validation, just like an unverified diner snagging a plate meant for someone else. An attacker could exploit this vulnerability to access arbitrary credit card on file (ccof) values, potentially leading to unauthorized charges. This is absolutely devastating for your customers and could result in financial losses and reputational damage for your site. It's a high-stakes game that nobody wants to play!
Think of it like a restaurant that lets anyone walk into the kitchen and grab orders, without checking who they are. This vulnerability allows attackers to request credit card information without any validation, just like an unverified diner snagging a plate meant for someone else. This vulnerability in the WooCommerce Square plugin arises from an Insecure Direct Object Reference (IDOR) due to missing validation on user-controlled keys in the get_token_by_id function, allowing unauthorized access to sensitive data.
An attacker could exploit this vulnerability to access arbitrary credit card on file (ccof) values, potentially leading to unauthorized charges. This is absolutely devastating for your customers and could result in financial losses and reputational damage for your site. It's a high-stakes game that nobody wants to play! To protect your site, update the WooCommerce Square plugin to version 5.1.2 or later immediately. Additionally, implement robust access controls and validate user input to prevent unauthorized data access in the future. You've got this! By taking these steps, you’ll fortify your site and keep your customers safe! 🛡️