WordPress Plugin Vulnerabilities

Revolut Gateway for WooCommerce < 4.17.4 - Missing Authorization to Unauthenticated Order Status Update

Description

The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders as completed.

Affects Plugins

Plugin icon
revolut-gateway-for-woocommerce
Fixed in 4.17.4

References

CVE
CVE-2024-8678
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/74dad6f0-0760-4420-b8cc-dc84cafd9b0d

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Jonas Höbenreich, Dmitry Derr, Thies Lukas
Verified
No
WPVDB ID
5e399ed5-1587-4e6c-98c6-62f594a22b3e

Timeline

Publicly Published
2024-09-24 (about 1 year ago)
Added
2024-09-24 (about 1 year ago)
Last Updated
2024-09-25 (about 1 year ago)

Other

Published
Title
Published
2026-02-18
Title
Checkout Field Manager (Checkout Manager) for WooCommerce < 7.8.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Published
2026-05-11
Title
Coinbase Commerce for Contact Form 7 <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter
Published
2026-05-24
Title
Quads Ads Manager for Google AdSense < 3.0.3 - Missing Authorization
Published
2026-02-17
Title
Blog2Social: Social Media Auto Post & Scheduler < 8.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
Published
2024-12-11
Title
Child Theme Creator by Orbisius < 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete