Razorpay for WooCommerce, b3b5a9ab191aa9218a81975fdc32d16d3db57aa9

CVE, Research URL: b3b5a9ab191aa9218a81975fdc32d16d3db57aa9
Home page URL: Security reports for Razorpay for WooCommerce
Application: Razorpay for WooCommerce
Published on: Nov 28, 2023
Research Description: Razorpay for WooCommerce [woo-razorpay] < 4.5.7 Razorpay for WooCommerce <= 4.5.6 - Missing Authorization The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification due to a missing capability check on several functions hooked via admin_post in all versions up to, and including, 4.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update, direct, create, and reverse transfers through the plugin.
Affected versions: max 4.5.7.
Status: vulnerable