CVE-2024-12264

The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly verifying a user's identity prior to setting the users ID and auth cookies. This makes it possible for unauthenticated attackers to create new administrative user accounts.

• CWE-287

• https://plugins.trac.wordpress.org/browser/payu-india/tags/3.8.3/includes/class-payu-shipping-tax-api-calculation.php#L187
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3217148%40payu-india&new=3217148%40payu-india&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bf037e4a-2dd7-4296-b86b-635901d2d68f?source=cve

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12259The CRM WordPress Plugin – RepairBuddy plugin for WordPress …8.8
• CVE-2024-1226The software does not neutralize or incorrectly neutralizes …7.5
• CVE-2024-12260The Ultimate Endpoints With Rest Api plugin for WordPress is…6.1
• CVE-2024-12261The SmartEmailing.cz plugin for WordPress is vulnerable to R…6.1
• CVE-2024-12262The Ebook Store plugin for WordPress is vulnerable to Reflec…6.1
• CVE-2024-12263The Child Theme Creator by Orbisius plugin for WordPress is …4.3
• CVE-2024-12265The Web3 Crypto Payments by DePay for WooCommerce plugin for…5.3
• CVE-2024-12266The ELEX WooCommerce Dynamic Pricing and Discounts plugin fo…6.5
• CVE-2024-12267The Drag and Drop Multiple File Upload – Contact Form 7 plug…9.1
• CVE-2024-12268The Responsive Blocks – WordPress Gutenberg Blocks plugin fo…5.4
• CVE-2024-12269The Safe Ai Malware Protection for WP plugin for WordPress i…7.5
• CVE-2024-1227An open redirect vulnerability, the exploitation of which co…6.5