Deposits And Partial Payments For Woocommerce
Monthly
Missing authorization in the Magepeople 'Deposits and Partial Payments for WooCommerce' plugin (CWE-862) through version 4.0.1 lets an authenticated low-privilege user - such as a registered customer or subscriber on a store with self-registration enabled - invoke plugin functionality that should be restricted to higher-privileged roles, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation requires only a valid low-privilege session and needs no user interaction, making it practical on typical storefronts where customer accounts are freely creatable. No public exploit code and no confirmed active exploitation were identified for this CVE at time of analysis; the flaw is reported by Patchstack and tracked in the EU ENISA database as EUVD-2026-95623.
Broken access control in the Deposits and Partial Payments for WooCommerce plugin (MagePeople Team) versions up to and including 3.1.0 allows unauthenticated network attackers to perform unauthorized integrity-impacting actions on deposit and partial payment functionality. The root cause is CWE-862 (Missing Authorization), meaning certain plugin endpoints or AJAX actions execute restricted operations without validating whether the caller has permission to do so. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Missing authorization in the Magepeople 'Deposits and Partial Payments for WooCommerce' plugin (CWE-862) through version 4.0.1 lets an authenticated low-privilege user - such as a registered customer or subscriber on a store with self-registration enabled - invoke plugin functionality that should be restricted to higher-privileged roles, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation requires only a valid low-privilege session and needs no user interaction, making it practical on typical storefronts where customer accounts are freely creatable. No public exploit code and no confirmed active exploitation were identified for this CVE at time of analysis; the flaw is reported by Patchstack and tracked in the EU ENISA database as EUVD-2026-95623.
Broken access control in the Deposits and Partial Payments for WooCommerce plugin (MagePeople Team) versions up to and including 3.1.0 allows unauthenticated network attackers to perform unauthorized integrity-impacting actions on deposit and partial payment functionality. The root cause is CWE-862 (Missing Authorization), meaning certain plugin endpoints or AJAX actions execute restricted operations without validating whether the caller has permission to do so. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.