Livees Checkout
Monthly
Unauthenticated attackers can manipulate arbitrary WooCommerce-style orders handled by the Livees Checkout WordPress plugin through version 7.0.2, because the order confirmation page processes request parameters without any capability, nonce, or order-key validation. This lets remote attackers change order statuses, inject arbitrary data and notes into orders, and recover order keys, degrading data integrity and leaking order information. Publicly available exploit code exists and WPScan has published the vulnerability, but there is no confirmed active exploitation (CISA KEV) at time of analysis; the assessed CVSS is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with impact bounded by the need to know or enumerate valid order identifiers and no code execution or availability loss.
Unauthenticated attackers can manipulate arbitrary WooCommerce-style orders handled by the Livees Checkout WordPress plugin through version 7.0.2, because the order confirmation page processes request parameters without any capability, nonce, or order-key validation. This lets remote attackers change order statuses, inject arbitrary data and notes into orders, and recover order keys, degrading data integrity and leaking order information. Publicly available exploit code exists and WPScan has published the vulnerability, but there is no confirmed active exploitation (CISA KEV) at time of analysis; the assessed CVSS is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with impact bounded by the need to know or enumerate valid order identifiers and no code execution or availability loss.