Netcash WooCommerce Payment Gateway Missing Authorization Vulnerability in Order Status Modification
Vulnerability
A vulnerability exists in the Netcash WooCommerce Payment Gateway plugin for WordPress, specifically in versions through 4.1.3. The issue arises from a lack of proper capability checks in the handle_return_url function, allowing unauthenticated attackers to alter the status of any WooCommerce order, marking it as processing or completed.
Impact
Exploitation of this vulnerability allows for unauthorized users to change the status of WooCommerce orders, potentially leading to improper order management and fulfillment.
Remediation
No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.