WooCommerce Anti-Fraud <= 3.2 - Insecure Direct Object Reference
2020-11-22 00:00
Brian HenryStrategic Overview
Vulnerability Overview
The WooCommerce Anti-Fraud plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) due to insufficient user validation on the paypal_verification() function in versions up to, and including, 3.2. This makes it possible for unauthenticated attackers to change any user's order status.
Technical Analysis
REMEDIATION: Update to version 3.3, or a newer patched version --- IDENTIFIER: CWE-639 (Authorization Bypass Through User-Controlled Key) The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C