Vulnerabilities

Automattic WooPayments any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

5CVEs

CVE-2023-28121

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

Published 2023-04-12 · Modified

9.8EPSS 0.865

CVE-2023-35915

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection

Published 2023-12-20 · Modified

9.8EPSS 0.007

CVE-2023-35916

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)

Published 2023-12-20 · Modified

7.5EPSS 0.006

CVE-2023-51503

WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)