CVE-2024-2382

—

CVSS 3.1

5.3 medium

EPSS

<1%p11

Published

Jun 4, 2024 (Jun 4, 2024)

Modified

Jun 17, 2026

Description

The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment.

Ecosystems: WordPress, E-commerce
Weakness: CWE-345
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.