Planetstudio Payment Gateway
Monthly
Missing authorization in the PlanetStudio Payment Gateway WordPress plugin (versions through 1.3.3) allows unauthenticated remote attackers to reach plugin functionality that should be gated behind an access-control or capability check, resulting in limited unauthorized modification of site state rather than data theft or takeover. Because the CVSS vector is PR:N/UI:N with C:N/I:L/A:N, exploitation requires only that the plugin be installed and active on an internet-reachable WordPress site and that the affected endpoint be reachable - no credentials and no victim interaction are needed, though the impact ceiling is low and integrity-only. The plugin has a small deployment footprint, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a genuine but moderate-priority issue rather than a critical emergency, so remediation should be scheduled rather than treated as an emergency outage.
Missing authorization in the PlanetStudio Payment Gateway WordPress plugin (versions through 1.3.3) allows unauthenticated remote attackers to reach plugin functionality that should be gated behind an access-control or capability check, resulting in limited unauthorized modification of site state rather than data theft or takeover. Because the CVSS vector is PR:N/UI:N with C:N/I:L/A:N, exploitation requires only that the plugin be installed and active on an internet-reachable WordPress site and that the affected endpoint be reachable - no credentials and no victim interaction are needed, though the impact ceiling is low and integrity-only. The plugin has a small deployment footprint, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a genuine but moderate-priority issue rather than a critical emergency, so remediation should be scheduled rather than treated as an emergency outage.