WordPress Plugin Vulnerabilities

PlatiOnline Payments < 7.0.1 - Missing Authorization

Description

The PlatiOnline Payments plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
plationline
Fixed in 7.0.1

References

CVE
CVE-2025-53288
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1dfd50-aeac-465a-a402-ba85c50fdfc5

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
norahc
Verified
No
WPVDB ID
172fbd07-e0f9-4d6b-9cd6-0b7dee27b788

Timeline

Publicly Published
2025-06-27 (about 1 year ago)
Added
2025-07-02 (about 1 year ago)
Last Updated
2026-01-13 (about 5 months ago)

Other

Published
Title
Published
2024-08-07
Title
TypeSquare Webfonts < 2.0.8 - Missing Authorization via typesquare_admin_init()
Published
2026-06-16
Title
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.4 - Missing Authorization
Published
2026-01-07
Title
GA4WP: Google Analytics for WordPress <= 2.10.0 - Missing Authorization
Published
2026-05-18
Title
wpForo Forum < 3.0.7 - Missing Authorization
Published
2025-03-13
Title
Resido - Real Estate WordPress Theme < 3.6.1 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings Update