CVE-2024-0619

MEDIO 5.3CVE-2024-0619 · Published 11/07/2024 · updated 17/06/2026

In breve

CVE-2024-0619 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda payment gateway (payflex).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.40%, superiore al 34.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
payment gateway payflex	`≤ 2.5.0`	No fix yet

Description

The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the payment_callback() function in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to update the status of orders, which can potentially lead to revenue loss.

References

plugins.trac.wordpress.org/changeset/3124507
wordfence.com/threat-intel/vulnerabilities/id/9f740cfa-7163-4634-9705-0e01ee571a11 · Third Party Advisory
plugins.trac.wordpress.org/browser/payflex-payment-gateway/trunk/partpay.php · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free