Kassa Woocommerce
Monthly
Sensitive data exposure in the Yukassa for WooCommerce plugin allows authenticated subscribers to access sensitive payment information, potentially including transaction details or customer data. The vulnerability affects plugin versions up to 2.16.1. No public exploit or active exploitation has been identified at the time of analysis.
Broken access control in YooKassa для WooCommerce plugin (versions up to and including 2.16.1) permits authenticated WordPress subscribers to perform privileged actions beyond their intended role boundary. The CVSS vector (PR:L, AV:N, I:L) confirms that any low-privileged authenticated user - specifically a WordPress subscriber, the lowest default role - can exploit missing authorization checks over the network without additional interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack, which specializes in WordPress vulnerability disclosure, reported this finding.
Sensitive data exposure in the Yukassa for WooCommerce plugin allows authenticated subscribers to access sensitive payment information, potentially including transaction details or customer data. The vulnerability affects plugin versions up to 2.16.1. No public exploit or active exploitation has been identified at the time of analysis.
Broken access control in YooKassa для WooCommerce plugin (versions up to and including 2.16.1) permits authenticated WordPress subscribers to perform privileged actions beyond their intended role boundary. The CVSS vector (PR:L, AV:N, I:L) confirms that any low-privileged authenticated user - specifically a WordPress subscriber, the lowest default role - can exploit missing authorization checks over the network without additional interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack, which specializes in WordPress vulnerability disclosure, reported this finding.