Bjorntech Swish For Woocommerce
Monthly
Missing authorization (CWE-862) in the BjornTech Swish for WooCommerce WordPress plugin at versions up to and including 3.7.8 lets unauthenticated remote attackers reach plugin endpoints that perform no access-control check, yielding limited reads and modifications of the protected Swish payment functionality (CVSS 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Only WooCommerce stores running this Sweden-specific Swish mobile-payment integration are exposed, so the practical attack surface is narrow geographic/vertical footprint rather than mass exploitation. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied with the source data.
Missing authorization (CWE-862) in the BjornTech Swish for WooCommerce WordPress plugin at versions up to and including 3.7.8 lets unauthenticated remote attackers reach plugin endpoints that perform no access-control check, yielding limited reads and modifications of the protected Swish payment functionality (CVSS 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Only WooCommerce stores running this Sweden-specific Swish mobile-payment integration are exposed, so the practical attack surface is narrow geographic/vertical footprint rather than mass exploitation. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied with the source data.