Fundiin Cho Woocommerce
Monthly
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin cho WooCommerce plugin through 3.4.0, because several of its REST API routes enforce authorization only through a credential that is hardcoded identically in every installation. Exploiting this yields disclosure of the store's payment gateway credentials and customer order data, allows the gateway configuration to be rewritten so that payments are credited to an attacker-controlled destination, and permits unpaid orders to be marked as paid; the same missing authorization additionally allows script to be stored and rendered unescaped on the classic WooCommerce checkout, producing unauthenticated stored XSS. CVSS 3.1 scores this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and publicly available exploit code exists per the WPScan report, while no CISA KEV entry was present in the supplied intelligence.
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin cho WooCommerce plugin through 3.4.0, because several of its REST API routes enforce authorization only through a credential that is hardcoded identically in every installation. Exploiting this yields disclosure of the store's payment gateway credentials and customer order data, allows the gateway configuration to be rewritten so that payments are credited to an attacker-controlled destination, and permits unpaid orders to be marked as paid; the same missing authorization additionally allows script to be stored and rendered unescaped on the classic WooCommerce checkout, producing unauthenticated stored XSS. CVSS 3.1 scores this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and publicly available exploit code exists per the WPScan report, while no CISA KEV entry was present in the supplied intelligence.