Description

WordPress Plugin PayPal for WooCommerce is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently perform a variety of the plugin's actions. WordPress Plugin PayPal for WooCommerce version 1.5.7 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://www.pluginvulnerabilities.com/2019/02/22/closed-popular-wordpress-plugin-paypal-for-woocommerce-contains-privilege-escalation-vulnerability/

Related Vulnerabilities

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Open Redirect (3.3.19)

Joomla! Core 1.5.x Session Hijacking (1.5.0 - 1.5.8)

WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Unspecified Vulnerability (1.5.55)

WordPress Plugin Webapp builder (Free mobile apps native iPhone iOS & Android Winphone mobile apps) Arbitrary File Upload (2.0)

WordPress Plugin Custom Login Page Customizer-LoginPress Multiple Vulnerabilities (1.1.13)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Tags

Missing Update Authentication Bypass