| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions. |
| Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. |
| Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions. |
| The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration. |
| Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Metro Magazine: from n/a through 1.4.1. |
| Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions. |
| Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions. |
| Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions. |
| Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions. |
| Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions. |
| Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions. |
| OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0. |
| Subscriber Broken Access Control in Groundhogg < 4.4.1 versions. |
| Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions. |
| Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions. |
| Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. |
| Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions. |
| Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions. |
| The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, which is registered to both the wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks. The handler takes a user-supplied recover_id parameter from $_POST and passes it directly to wp_delete_post() with the force-delete flag set to true, without verifying that the ID belongs to the plugin's own cf7af_data post type. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, or other content on the affected site by sending a single admin-ajax. |
| Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions. |
