Pay With Vipps For Woocommerce
Monthly
An authorization bypass (IDOR, CWE-639) in the Pay with Vipps for WooCommerce WordPress plugin, versions through 6.2.4, lets an authenticated, logged-in user retrieve order or customer records belonging to other users by supplying a manipulated, user-controlled object key. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) shows the attacker must already hold a valid account (PR:L), that no user interaction is needed, and that the impact is limited to low confidentiality loss with no integrity or availability effect. Our independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this as moderate-severity and low real-world risk, confined to WooCommerce stores that actually use the Vipps payment method; no public exploit identified at time of analysis.
An authorization bypass (IDOR, CWE-639) in the Pay with Vipps for WooCommerce WordPress plugin, versions through 6.2.4, lets an authenticated, logged-in user retrieve order or customer records belonging to other users by supplying a manipulated, user-controlled object key. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) shows the attacker must already hold a valid account (PR:L), that no user interaction is needed, and that the impact is limited to low confidentiality loss with no integrity or availability effect. Our independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this as moderate-severity and low real-world risk, confined to WooCommerce stores that actually use the Vipps payment method; no public exploit identified at time of analysis.