Paymaya Business WordPress Plugin Authorization Bypass Vulnerability Allowing Insecure Direct Object References

A vulnerability allowing authorization bypass through user-controlled keys has been identified in the Paymaya Business WordPress plugin, specifically in versions through 1.2.0. This issue arises from inadequate access control, enabling users to access functionalities that should be restricted.

Impact

Exploitation of this vulnerability could lead to Insecure Direct Object References (IDOR), allowing unauthorized access to sensitive information or functionalities.

Remediation

Users of the Paymaya Business WordPress plugin should update to version 1.3.0 or later. Patchstack users can enable auto-update for vulnerable plugins.