60
CVE-2023-28121
—CVSS 3.1
9.8 critical
EPSS
87%p100
Published
()
Modified
Description
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
- Vendors
- automattic
- Products
- woocommerce payments, woopayments
- Ecosystems
- WordPress, E-commerce
- Weakness
- CWE-287
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news5 stories
Zero-Day Attacks Exploited Critical Vulnerability in Citrix ADC and Gateway
60
60
60
60