The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders as completed.
Metrics
Affected Vendors & Products
References
History
Wed, 02 Oct 2024 19:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Revolut revolut Gateway For Woocommerce
|
|
CPEs | cpe:2.3:a:revolut:revolut_gateway_for_woocommerce:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Revolut revolut Gateway For Woocommerce
|
Wed, 25 Sep 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Revolut
Revolut revolut Gateway |
|
CPEs | cpe:2.3:a:revolut:revolut_gateway:*:*:*:*:*:*:*:* | |
Vendors & Products |
Revolut
Revolut revolut Gateway |
|
Metrics |
ssvc
|
Wed, 25 Sep 2024 07:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders as completed. | |
Title | Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update | |
Weaknesses | CWE-862 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-25T06:49:00.721Z
Updated: 2024-09-25T13:23:50.813Z
Reserved: 2024-09-10T20:05:16.391Z
Link: CVE-2024-8678
Vulnrichment
Updated: 2024-09-25T13:23:43.697Z
NVD
Status : Analyzed
Published: 2024-09-25T07:15:03.907
Modified: 2024-10-02T19:06:48.983
Link: CVE-2024-8678
Redhat
No data.