CVE-2024-2382

The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment.

• CWE-345

• https://plugins.trac.wordpress.org/browser/authorizenet-payment-gateway-for-woocommerce/trunk/index.php#L205
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab71d24-0409-421b-8abf-f4d5390a32a1?source=cve
• https://plugins.trac.wordpress.org/browser/authorizenet-payment-gateway-for-woocommerce/trunk/index.php#L205
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab71d24-0409-421b-8abf-f4d5390a32a1?source=cve

Published

Jun 4, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23814The integrated ICMP service of the network stack of affected…6.9
• CVE-2024-23815A vulnerability has been identified in Desigo CC (All versio…8.7
• CVE-2024-23816A vulnerability has been identified in Location Intelligence…9.8
• CVE-2024-23817Dolibarr is an enterprise resource planning (ERP) and custom…6.1
• CVE-2024-23818GeoServer is an open source software server written in Java …4.8
• CVE-2024-23819GeoServer is an open source software server written in Java …4.8
• CVE-2024-23820OpenFGA, an authorization/permission engine, is vulnerable t…6.5
• CVE-2024-23821GeoServer is an open source software server written in Java …4.8
• CVE-2024-23822Thruk is a multibackend monitoring webinterface. Prior to 3…9.8
• CVE-2024-23823vantage6 is an open source framework built to enable, manage…6.5
• CVE-2024-23824mailcow is a dockerized email package, with multiple contain…2.7
• CVE-2024-23825TablePress is a table plugin for Wordpress. For importing ta…4.9