Strix
26.1K

CVE-2023-28121

CRITICALCVSS 9.8/10EPSS 86.92%

Last modified

CVE-2023-28121 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.. EPSS estimates a 86.92% chance of exploitation in the next 30 days.

Description

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
86.92%

99.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
AutomatticWoocommerce Payments>= 4.8.0, < 4.8.2
AutomatticWoocommerce Payments>= 5.0.0, < 5.0.4
AutomatticWoocommerce Payments>= 5.1.0, < 5.1.3
AutomatticWoocommerce Payments>= 5.2.0, < 5.2.2
AutomatticWoocommerce Payments>= 5.5.0, < 5.5.2
AutomatticWoopayments>= 5.6.0, < 5.6.2
AutomatticWoopayments4.9.0
AutomatticWoopayments5.3.0
AutomatticWoopayments5.4.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-28121?
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
How severe is CVE-2023-28121?
CVE-2023-28121 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 86.92% probability of exploitation in the next 30 days.
How do I fix CVE-2023-28121?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-28121?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST