Aplazo Payment Gateway WordPress Plugin Missing Authorization Vulnerability in Order Status Manipulation
Vulnerability
A vulnerability exists in the Aplazo Payment Gateway plugin for WordPress, affecting all versions up to and including 1.4.2. The issue arises from a lack of proper capability checks in the check_success_response() function, allowing unauthenticated attackers to change the status of any WooCommerce order to 'pending payment'.
Impact
Exploitation of this vulnerability allows for unauthorized changes to WooCommerce order statuses, potentially disrupting order management and payment processing.
Remediation
No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.