CVE-2023-28121

Description

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

Affected products

Vendor	Product	Affected	Fixed
—	WooCommerce Payments WordPress Plugin	Fixed version 5.6.2	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Wordpress Plugin WooCommerce Payments Unauthenticated Admin Creation
auxiliary/scanner/http/wp_woocommerce_payments_add_user

GitHub 8 repositories

gbrsh/CVE-2023-28121 ★ 40 · Mar 30, 2023

WooCommerce Payments: Unauthorized Admin Access Exploit
im-hanzou/Mass-CVE-2023-28121 ★ 11 · Jul 12, 2023

CVE-2023-28121 - WooCommerce Payments < 5.6.2 - Unauthenticated Privilege Escalation [ Mass Add Admin User ]
luisdevpentest/CVE-2023-28121-WordPress-Privilege-Escalation ★ 1 · Apr 30, 2026

Exploração prática de vulnerabilidade crítica no WordPress usando o plugin WooCommerce Payments.
rio128128/Mass-CVE-2023-28121-kdoec ★ 1 · Jul 12, 2023

CVE-2023-28121 - WooCommerce Payments < 5.6.2 - Unauthenticated Privilege Escalation [ Mass Add Admin User ]
0axz-tools/CVE-2023-28121 ★ 0 · Oct 19, 2025
sug4r-wr41th/CVE-2023-28121 ★ 0 · Apr 12, 2025

WooCommerce Payments (WordPress plugin) =< 5.6.1 CVE-2023-28121 PoC
1337nemojj/CVE-2023-28121 ★ 0 · Nov 3, 2023

Python research notes and tooling for CVE-2023-28121
Jenderal92/WP-CVE-2023-28121 ★ 0 · Nov 3, 2023

Wordpress CVE-2023-28121

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

WooCommerce Payments - Unauthorized Admin Access http/cves/2023/CVE-2023-28121.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on beh…