References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

https://wpscan.com/vulnerability/0653ccce-5427-4ffc-a34c-18b45710d9f3/

[{"vendor":"Unknown","product":"Subscriptions for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"2.0.1","versionType":"semver","status":"affected"}]}]