Bitcoin Lightning Payment Gateway For Woocommerce Via Clink
Monthly
Broken access control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions 1.0.7 and below exposes one or more plugin endpoints - almost certainly WordPress AJAX handlers or REST API routes - without the required capability checks, allowing unauthenticated remote attackers to perform privileged actions with high integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms no credentials are needed and exploitation requires no user interaction, making this trivially scriptable against any internet-facing WordPress store running the affected plugin. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the attack conditions are permissive enough to make opportunistic exploitation straightforward.
Broken access control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions 1.0.7 and below exposes one or more plugin endpoints - almost certainly WordPress AJAX handlers or REST API routes - without the required capability checks, allowing unauthenticated remote attackers to perform privileged actions with high integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms no credentials are needed and exploitation requires no user interaction, making this trivially scriptable against any internet-facing WordPress store running the affected plugin. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the attack conditions are permissive enough to make opportunistic exploitation straightforward.