Yaad Sarig Payment Gateway For Wc
Monthly
Broken access control in the Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 lets any authenticated user - including the lowest-privilege Subscriber role - act on and alter WooCommerce orders that belong to other customers. The flaw sits in several of the plugin's order payment-processing actions, which perform neither an authorization check nor an ownership check against the supplied order identifier (CWE-639, CVSS 4.3). Exploitation requires only a valid account and no user interaction, and publicly available exploit code exists; however, per CISA's SSVC assessment, exploitation has not been observed (no KEV listing) and the impact is bounded to order integrity with no confidentiality, availability, or privilege-escalation effect.
Broken access control in the Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 lets any authenticated user - including the lowest-privilege Subscriber role - act on and alter WooCommerce orders that belong to other customers. The flaw sits in several of the plugin's order payment-processing actions, which perform neither an authorization check nor an ownership check against the supplied order identifier (CWE-639, CVSS 4.3). Exploitation requires only a valid account and no user interaction, and publicly available exploit code exists; however, per CISA's SSVC assessment, exploitation has not been observed (no KEV listing) and the impact is bounded to order integrity with no confidentiality, availability, or privilege-escalation effect.