Description
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PI Websolution | PiWeb Disable payment method / Partial payment for WooCommerce | < 1.1.10.9 | 1.1.10.9 |
References
- https://plugins.svn.wordpress.org/disable-payment-method-for-woocommerce/tags/1.1.10.7/public/class-apply-order-fees.php technical-description
- https://plugins.trac.wordpress.org/changeset/3751777/disable-payment-method-for-woocommerce patch
- https://wordpress.org/plugins/disable-payment-method-for-woocommerce/ product
- VulnCheck Advisory: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees third-party-advisory