High severity · published Jul 24, 2024
CVE-2024-7027
WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is due to insufficient verification on the user being supplied during a QR code login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing Voucher Vendor user on the site, if they have access to the user id.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
WooCommerce - PDF Vouchers · WPWeb
through 4.9.3 · source: vendor
WP
Woocommerce Pdf Vouchers · Wpweb
through 4.9.3 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7027
codecanyon.net
https://codecanyon.net/item/woocommerce-pdf-vouchers-ultimate-gift-cards-wordpress-plugin/7392046
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/b6cf27d9-c0be-4cff-8867-19297f6d79d7?source=cve
More from WooCommerce - PDF Vouchers
9.8
CVE-2024-54383
WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability
9.8
CVE-2024-39650
WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Multiple Vulnerabilities
9.3
CVE-2024-39651
WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability
6.1
CVE-2024-56265
WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerability