Medium · 5.9 CVE-2023-51503 EUVD-2023-56216GHSA-mg36-6hj2-xj8q

WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)

Published Dec 31, 2023 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Automattic Product: WooPayments – Fully Integrated Solution Built and Supported by Woo

Description

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.

Affected products

Vendor	Product	Affected	Fixed
Automattic	WooPayments – Fully Integrated Solution Built and Supported by Woo	≤ 6.9.2	—

References

https://patchstack.com/database/vulnerability/woocommerce-payments/wordpress-woopayments-plugin-6-6-2-unauthenticated-insecure-direct-object-references-idor-vulnerability?_s_id=cve vdb-entry