Vulnerability · Published Jan 7, 2025 · Assigned by Wordfence
CVE-2024-12264PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation
Critical 9.8
In plain English
A critical-severity improper authentication in PayU CommercePro Plugin from payuplugin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Official description
The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly verifying a user's identity prior to setting the users ID and auth cookies. This makes it possible for unauthenticated attackers to create new administrative user accounts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| payuplugin | PayU CommercePro Plugin | 0 – through 3.8.3 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bf037e4a-2dd7-4296-b86b-635901d2d68f?source=cve
- https://plugins.trac.wordpress.org/browser/payu-india/tags/3.8.3/includes/class-payu-shipping-tax-api-calculation.php#L187
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3217148%40payu-india&new=3217148%40payu-india&sfp_email=&sfph_mail=