CVE-2023-2179
Published: 15 May 2023
Summary
CVE-2023-2179 is a medium-severity an unspecified weakness vulnerability in Woocommerce Woocommerce Order Status Change Notifier. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 32.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-33696
Vulnerability details
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update…
more
arbitrary order status, making them paid without actually paying for them for example
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.