Yan&Co vulnerabilities

Products

• WooCommerce CVR Payment Gateway 1
• WooCommerce EAN Payment Gateway 1

Latest Yan&Co CVEs

Newest publication first

1. CVE-2023-4947 WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update

   Published 2023-10-20

   Medium·CVSS 4.3 EPSS 0.43%

   The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-lev...

2. CVE-2023-4948 WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update

   Published 2023-09-14

   Medium·CVSS 4.3 EPSS 0.39%

   The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-lev...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.