Bayarcash Woocommerce
Monthly
Missing authorization checks in the Bayarcash WooCommerce WordPress plugin (all versions through 4.4.2) let unauthenticated remote attackers reach functionality that should be restricted to privileged users, allowing unauthorized changes to payment-related configuration or transaction state. The flaw carries CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), i.e. network-reachable, low complexity, no credentials and no user interaction, with a pure integrity impact and no confidentiality loss or denial of service. Exposure is bounded by deployment scope rather than configuration: the site must be running the plugin, and because Bayarcash is a Malaysia-focused payment gateway the realistic victim set is merchants using that gateway. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Missing authorization checks in the Bayarcash WooCommerce WordPress plugin (all versions through 4.4.2) let unauthenticated remote attackers reach functionality that should be restricted to privileged users, allowing unauthorized changes to payment-related configuration or transaction state. The flaw carries CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), i.e. network-reachable, low complexity, no credentials and no user interaction, with a pure integrity impact and no confidentiality loss or denial of service. Exposure is bounded by deployment scope rather than configuration: the site must be running the plugin, and because Bayarcash is a Malaysia-focused payment gateway the realistic victim set is merchants using that gateway. No public exploit code or confirmed active exploitation has been identified at time of analysis.