Vulnerability Details : CVE-2023-2179
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
Vulnerability category: Cross-site request forgery (CSRF)
Products affected by CVE-2023-2179
- Woocommerce » Woocommerce Order Status Change Notifier » For WordpressVersions up to, including, (<=) 1.1.0cpe:2.3:a:woocommerce:woocommerce_order_status_change_notifier:*:*:*:*:*:wordpress:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-2179
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 41 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-2179
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2023-2179
-
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Assigned by: contact@wpscan.com (Primary)
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: contact@wpscan.com (Primary)
References for CVE-2023-2179
-
https://wpscan.com/vulnerability/fbc56973-4225-4f44-8c38-d488e57cd551
Just a moment...Exploit
Jump to