WordPress Plugin Vulnerabilities

BNG Gateway For Woocommerce <= 1.6.10 - CSRF Bypass

Description

The plugin does not properly perform CSRF checks, allowing attackers to make logged in users perform unwanted actions, such as add a new billing method to an existing customer, and delete a payment method.

Affects Plugins

Plugin icon
bng-gateway-for-woocommerce
No known fix

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
32089eee-e034-4460-9996-e7324d00eb1b

Timeline

Publicly Published
2021-06-30 (about 4 years ago)
Added
2021-06-30 (about 4 years ago)
Last Updated
2021-06-30 (about 4 years ago)

Other

Published
Title
Published
2025-03-24
Title
Awesome Logos <= 1.2 - Cross-Site Request Forgery to SQL Injection
Published
2025-01-24
Title
Really Simple SSL < 9.2.0 - Cross-Site Request Forgery
Published
2022-05-09
Title
JivoChat < 1.3.5.4 - Stored Cross-Site Scripting via CSRF
Published
2014-08-01
Title
DVS Custom Notification - Cross-Site Request Forgery
Published
2026-01-08
Title
Clearfy < 2.4.1 - Cross-Site Request Forgery to Update Notification Tampering