PT-2026-4856 · Unknown+1 · Woocommerce+1
CVE-2025-14971
·
Publicado
2026-01-27
·
Atualizado
2026-01-27
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Link Invoice Payment for WooCommerce versions up to and including 2.8.0
Description
The Link Invoice Payment for WooCommerce plugin for WordPress has a flaw where data can be modified without authorization. This is due to a missing capability check in the
createPartialPayment and cancelPartialPayment functions. Unauthenticated attackers can create partial payments for any order or cancel existing partial payments by enumerating IDs.Recommendations
Update Link Invoice Payment for WooCommerce to a version later than 2.8.0.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Link Invoice Payment For Woocommerce
Woocommerce