Vchasno Kasa WordPress Plugin Missing Capability Check Vulnerability Allows Unauthenticated Invoice Generation

A vulnerability exists in the Vchasno Kasa plugin for WordPress, specifically in versions through 1.0.3. The issue arises from a lack of proper capability checks in the 'mrkv_vchasno_kasa_wc_do_metabox_action()' function. This flaw enables unauthenticated attackers to generate invoices for any order.

Impact

Exploitation of this vulnerability allows for unauthorized invoice generation on behalf of any order, potentially leading to financial discrepancies or fraudulent activity.

Reproduction

To reproduce this vulnerability, send a POST request to the 'admin-ajax.php' endpoint with the action 'submit_morkva_vchasno_kasa', along with a valid nonce. The request can include an 'order_id' parameter specifying the order for which the invoice should be generated. The absence of proper authorization checks allows this action to be performed by unauthenticated users.

Remediation

Users are advised to update the Vchasno Kasa WordPress plugin to version 1.0.4 or later.