CVE-2024-1719mediumCWE-352

CVE-2024-1719: falha de média gravidade em scottpaterson Easy PayPal & Stripe Buy Now…

Easy PayPal & Stripe Buy Now Button <= 1.8.3 & Contact Form 7 – PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Contact Form 7 – PayPal & Stripe Add-on+ Monitorar Easy PayPal & Stripe Buy Now Button

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Produtos afetados
scottpaterson · Contact Form 7 – PayPal & Stripe Add-onscottpaterson · Easy PayPal & Stripe Buy Now Button
CVEs relacionadas — scottpaterson Easy PayPal & Stripe Buy Now…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-10683MEDIUMContact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-9189MEDIUMContact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)EPSS 0.2%