CVE-2021-39347
Last modified
CVE-2021-39347 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.. EPSS estimates a 0.65% chance of exploitation in the next 30 days.
Description
The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Paymentplugins | Stripe For Woocommerce | >= 3.0.0, <= 3.3.9 |
References
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39347Third Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39347Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-39347?
How severe is CVE-2021-39347?
How do I fix CVE-2021-39347?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-39341The OptinMonster WordPress plugin is vulnerable to sensitive…8.2
- CVE-2021-39342The Credova_Financial WordPress plugin discloses a site's as…7.5
- CVE-2021-39343The MPL-Publisher WordPress plugin is vulnerable to Stored C…4.8
- CVE-2021-39344The KJM Admin Notices WordPress plugin is vulnerable to Stor…4.8
- CVE-2021-39345The HAL WordPress plugin is vulnerable to Stored Cross-Site …4.8
- CVE-2021-39346The Google Maps Easy WordPress plugin is vulnerable to Store…4.8
- CVE-2021-39348The LearnPress WordPress plugin is vulnerable to Stored Cros…4.8
- CVE-2021-39349The Author Bio Box WordPress plugin is vulnerable to Stored …4.8
- CVE-2021-3935When PgBouncer is configured to use "cert" authentication, a…8.1
- CVE-2021-39350The FV Flowplayer Video Player WordPress plugin is vulnerabl…6.1
- CVE-2021-39351The WP Bannerize WordPress plugin is vulnerable to authentic…6.5
- CVE-2021-39352The Catch Themes Demo Import WordPress plugin is vulnerable …7.2
Are you affected by CVE-2021-39347?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST