Description
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
Published: 2023-05-15
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-33696 The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
History

Fri, 24 Jan 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Woocommerce Woocommerce Order Status Change Notifier
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2025-01-24T20:47:15.118Z

Reserved: 2023-04-19T09:47:37.440Z

Link: CVE-2023-2179

cve-icon Vulnrichment

Updated: 2024-08-02T06:12:20.572Z

cve-icon NVD

Status : Modified

Published: 2023-05-15T13:15:10.870

Modified: 2025-01-24T21:15:10.300

Link: CVE-2023-2179

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.