WordPress Plugin Vulnerabilities

NMI Gateway For WooCommerce <= 1.6.11 - CSRF Bypass

Description

The plugin does not properly check for CSRF in its bng701_stepOne_addBilling, bng701_stepOne and bng701_deletePaymentMethod functions, allowing attacker to make logged in users call them and perform unwanted actions.

Affects Plugins

Plugin icon
woo-nmi-three-step
No known fix

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
b95d98e3-989d-45f0-b3d8-3b8bb6af8625

Timeline

Publicly Published
2021-07-05 (about 4 years ago)
Added
2021-07-05 (about 4 years ago)
Last Updated
2021-07-05 (about 4 years ago)

Other

Published
Title
Published
2023-11-14
Title
Thrive Theme Builder < 3.24.2 - Cross-Site Request Forgery
Published
2026-01-23
Title
Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update
Published
2023-01-04
Title
FL3R FeelBox <= 8.1 - Moods Reset via CSRF
Published
2025-09-26
Title
Javo Core <= 3.0.0.266 - Cross-Site Request Forgery
Published
2023-09-05
Title
Order Delivery Date for WP e-Commerce <= 1.2 - Settings Update via CSRF