Security restrictions bypass in WooCommerce PayPal Checkout Payment Gateway - CVE-2019-7441
Published: July 8, 2019 / Updated: June 17, 2021
Vulnerability identifier: #VU19046
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-7441
CWE-ID: CWE-471
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to application does not perform validation of the attacker-controlled data, assuming that data is valid and safe. A remote attacker can tamper with parameters, passed to the application, and change its flow, e.g. purchase and item for lower price.
Affected software
WooCommerce PayPal Checkout Payment Gateway
How to mitigate CVE-2019-7441
Install updates from vendor's website.
WooCommerce PayPal Checkout Payment Gateway - update to 1.6.9