PT-2020-12647 · Automattic+2 · Woocommerce+2

Jack Misiura · Published 2020-08-26 · Updated 2020-09-01 · CVE-2020-11497

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NAB Transact extension version 2.1.0 for the WooCommerce plugin for WordPress

Description An issue allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step, effectively bypassing the online payment system.

Recommendations For NAB Transact extension version 2.1.0, update to a newer version that contains a fix for this issue, as assigning arbitrary bank transaction IDs could lead to unauthorized order fulfillment. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2020-11497

Affected Products

Nab Transact Extension

Woocommerce

Wordpress

References · 5

• 🔥 http://seclists.org/fulldisclosure/2020/Aug/13 · Exploit
• 🔥 https://themissinglink.com.au/security-advisories-cve-2020-11497 · Exploit
• https://osv.dev/vulnerability/CVE-2020-11497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11497 · Security Note
• http://packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.html · Note