CVE-2024-0619

Name of the Vulnerable Software and Affected Versions Payflex Payment Gateway plugin for WordPress versions up to, and including, 2.5.0

Description The issue is related to a missing capability check on the payment callback() function, allowing unauthenticated attackers to update the status of orders. This could potentially lead to revenue loss.

Recommendations For versions up to, and including, 2.5.0, update to a version higher than 2.5.0 to resolve the issue. As a temporary workaround, consider disabling the payment callback() function until a patch is available.