Improper Authentication in WooCommerce Payments - #VU74152
Published: March 29, 2023
Vulnerability identifier: #VU74152
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected application.
The vulnerability exists due to an error in the authentication process, related to the determine_current_user_for_platform_checkout() function. A remote non-authenticated attacker can bypass authentication process and gain administrative access to the web application.
Note, the vulnerability is being actively exploited in the wild.
Affected software
WooCommerce Payments
Remediation
Install updates from vendor's website.
WooCommerce Payments - addressed in versions 4.8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2