CVE-2023-4040
Published: 18 August 2023
Summary
CVE-2023-4040 is a medium-severity an unspecified weakness vulnerability in Webtoffee Stripe Payment Plugin For Woocommerce. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53932
Vulnerability details
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to, and including, 3.7.9. This makes it possible for unauthenticated attackers…
more
to modify the order status of arbitrary WooCommerce orders.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.