Vulnerability · Published Mar 13, 2024 · Assigned by Wordfence
CVE-2024-0631Duitku Payment Gateway <= 2.11.6 - Missing Authorization via check_duitku_response
Medium 5.3
In plain English
A medium-severity improper access control in Duitku Payment Gateway from rayhanduitku. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 49.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_duitku_response function in all versions up to, and including, 2.11.6. This makes it possible for unauthenticated attackers to change the payment status of orders to failed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rayhanduitku | Duitku Payment Gateway | 0 – through 2.11.6 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a33de35f-1c9d-4fc9-9be8-0a1c7d9352ec?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3047645%40duitku-social-payment-gateway&new=3047645%40duitku-social-payment-gateway&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/browser/duitku-social-payment-gateway/trunk/woocommerce-gateway-duitku.php#L409 x_transferred