Description
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Paymob for WooCommerce | < 4.1.14 | 4.1.14 |
References
- https://wpscan.com/vulnerability/91c2d07f-0489-4b47-ac04-bc892d9fee5a/ exploit vdb-entry technical-description