Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites

Patches have been unveiled for a critical security flaw impacting the WooCommerce Payments plugin for WordPress, which is set up on over 500,000 internet sites.

The flaw, if left unresolved, could permit a terrible actor to gain unauthorized admin access to impacted retailers, the corporation reported in an advisory on March 23, 2023. It impacts versions 4.8. through 5.6.1.

Set in another way, the issue could permit an “unauthenticated attacker to impersonate an administrator and wholly choose above a web site without having any consumer interaction or social engineering demanded,” WordPress security business Wordfence explained.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The vulnerability appears to reside in a PHP file called “class-system-checkout-session.php,” Sucuri researcher Ben Martin pointed out.

Credited with discovering and reporting the vulnerability is Michael Mazzolini of Swiss penetration testing company GoldNetwork.

WooCommerce also said it labored with WordPress to vehicle-update websites employing impacted variations of the program. Patched versions involve 4.8.2, 4.9.1, 5..4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, and 5.6.2.

WEBINARDiscover the Concealed Hazards of 3rd-Party SaaS Applications

Are you mindful of the dangers related with third-party app access to your firm’s SaaS applications? Be a part of our webinar to understand about the forms of permissions remaining granted and how to lessen risk.

RESERVE YOUR SEAT

On top of that, the maintainers of the e-commerce plugin famous that it really is disabling the WooPay beta program owing to concerns that the security defect has the potential to effects the payment checkout services.

There is no proof that the vulnerability has been actively exploited to date, but it can be envisioned to be weaponized on a significant scale the moment a proof-of-concept turns into out there, Wordfence researcher Ram Gall cautioned.

Moreover updating to the hottest model, people are encouraged to test for newly additional admin customers, and if so, modify all administrator passwords and rotate payment gateway and WooCommerce API keys.

Identified this write-up fascinating? Comply with us on Twitter  and LinkedIn to examine more unique information we publish.