Paypal Brasil Para Woocommerce
Monthly
Unauthenticated attackers can disable or re-enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings in the PayPal Brasil para WooCommerce plugin (vendor odefranca) for WordPress, in all versions up to and including 1.7.8, silently removing PayPal from checkout for every customer on the store. The flaw is a missing-authorization defect (CWE-862): the plugin's BCDC activate and settings handlers never verify that the caller is permitted to perform the action, so the request needs no credentials (PR:N) and no user interaction (UI:N), though impact stays integrity-only (C:N/I:L/A:N, CVSS 5.3) with no data disclosure or code execution. Wordfence reports the issue and a plugin-repository changeset (r3744502) is referenced; no public exploit code has been identified at time of analysis, and the priority is this_month rather than emergency response.
Unauthenticated attackers can disable or re-enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings in the PayPal Brasil para WooCommerce plugin (vendor odefranca) for WordPress, in all versions up to and including 1.7.8, silently removing PayPal from checkout for every customer on the store. The flaw is a missing-authorization defect (CWE-862): the plugin's BCDC activate and settings handlers never verify that the caller is permitted to perform the action, so the request needs no credentials (PR:N) and no user interaction (UI:N), though impact stays integrity-only (C:N/I:L/A:N, CVSS 5.3) with no data disclosure or code execution. Wordfence reports the issue and a plugin-repository changeset (r3744502) is referenced; no public exploit code has been identified at time of analysis, and the priority is this_month rather than emergency response.