CVE-2023-28121: vulnerability in WooCommerce Payments WordPress Plugin
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 87%
from disclosure to weaponsame day
Published on NVDApr 12
1st PoCMar 30
metasploitMar 22
VulnCheck+96d
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
Affected products
n/a · WooCommerce Payments WordPress Pluginpublic PoCs found — 7
vulncheckvulncheck.com/xdb/e34ca4e13deaunverifiedvulncheckvulncheck.com/xdb/9092018b0a70unverifiedvulncheckvulncheck.com/xdb/32504a4af454unverifiedvulncheckvulncheck.com/xdb/e41ed16d884eunverifiedvulncheckvulncheck.com/xdb/4072f1ae9388unverifiedvulncheckvulncheck.com/xdb/49ab6d9eba83unverifiedvulncheckvulncheck.com/xdb/8e2918e59eb2unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.