PayU India WordPress Plugin Authentication Bypass Vulnerability Allowing Account Takeover

A vulnerability allowing authentication bypass has been identified in the PayU India WordPress plugin, affecting versions through 3.8.5. This vulnerability allows malicious actors to abuse authentication mechanisms, potentially leading to unauthorized actions that should be restricted to users with higher privileges, such as administrative access.

Impact

Exploitation of this vulnerability could allow an attacker to bypass authentication and gain administrative privileges on the affected WordPress site, leading to unauthorized access and control over the site.

Remediation

Users of the PayU India WordPress plugin are advised to update to the latest version. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.