CVE-2024-0626

Name of the Vulnerable Software and Affected Versions WooCommerce Clover Payment Gateway plugin for WordPress versions up to, and including, 1.3.1

Description The issue allows unauthorized modification of data due to a missing capability check on the callback handler function. This makes it possible for unauthenticated attackers to mark orders as paid.

Recommendations For versions up to, and including, 1.3.1, update to a version higher than 1.3.1 to resolve the issue. As a temporary workaround, consider disabling the callback handler function until a patch is available.