CVE-2023-2179

WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example

Affected

WooCommerce Order Status Change Notifier

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2023-05-15

Updated

2025-01-24

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/fbc56973-4225-4f44-8c38-d488e57cd551

References

• CVE Record
• NVD entry