Synchrony Financing
Monthly
Broken authorization on a plugin REST route lets unauthenticated attackers take over existing WooCommerce orders on stores running the Synchrony Financing WordPress plugin (affected range 1.0.5 up to, but not including, 1.1.2) - reassigning an order to an account they control, altering its contents, and reading the associated customer's personal data. Rated CVSS 6.5 (CWE-863) with a network-reachable, no-prerequisite attack path (AV:N/AC:L/PR:N/UI:N), the flaw is narrow in deployment scope but exposes customer PII wherever it is present, and publicly available exploit code exists. No confirmed active exploitation (CISA KEV) was observed at time of analysis, and a vendor-released patch (1.1.2) is available.
Broken authorization on a plugin REST route lets unauthenticated attackers take over existing WooCommerce orders on stores running the Synchrony Financing WordPress plugin (affected range 1.0.5 up to, but not including, 1.1.2) - reassigning an order to an account they control, altering its contents, and reading the associated customer's personal data. Rated CVSS 6.5 (CWE-863) with a network-reachable, no-prerequisite attack path (AV:N/AC:L/PR:N/UI:N), the flaw is narrow in deployment scope but exposes customer PII wherever it is present, and publicly available exploit code exists. No confirmed active exploitation (CISA KEV) was observed at time of analysis, and a vendor-released patch (1.1.2) is available.