CVE-2024-0619

MITTEL 5.3CVE-2024-0619 · Published 11/07/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-0619 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in payment gateway (payflex).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.40%, höher als bei 34.7% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
payment gateway payflex	`≤ 2.5.0`	No fix yet

Description

The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the payment_callback() function in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to update the status of orders, which can potentially lead to revenue loss.

References

plugins.trac.wordpress.org/changeset/3124507
wordfence.com/threat-intel/vulnerabilities/id/9f740cfa-7163-4634-9705-0e01ee571a11 · Third Party Advisory
plugins.trac.wordpress.org/browser/payflex-payment-gateway/trunk/partpay.php · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free