PT-2023-21579 · WordPress · Woocommerce Payments

Michael Mazzolini · Published 2023-04-12 · Updated 2024-10-17 · CVE-2023-28121

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce Payments plugin for WordPress versions 5.6.1 and lower

Description An issue in the WooCommerce Payments plugin for WordPress allows an unauthenticated attacker to send requests on behalf of an elevated user, such as an administrator. This enables a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated. Researchers have discovered over 1 million attempts to compromise the plugin, with attacks peaking at 1.3 million on 157,000 sites. The attackers aim to gain administrator rights and install malicious plugins, allowing them to execute malicious code and capture control of vulnerable sites.

Recommendations For versions 5.6.1 and lower, update to a version higher than 5.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality until a patch is applied. Avoid using the plugin's elevated user features until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-28121

Affected Products

Woocommerce Payments

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_woocommerce_payments_add_user.rb · Exploit
• 🔥 https://github.com/gbrsh/CVE-2023-28121 · Exploit
• 🔥 https://github.com/im-hanzou/Mass-CVE-2023-28121 · Exploit
• https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28121 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28121 · Vendor Advisory
• https://t.me/thehackernews/3609 · Telegram Post
• https://t.me/true_secator/6332 · Telegram Post
• https://t.me/zerodayalert/7 · Telegram Post
• https://t.me/poxek/3043 · Telegram Post
• https://rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce · Note
• https://t.me/yah_channel/683 · Telegram Post
• https://t.me/cvenotify/48807 · Telegram Post