CVE-2023-7289: Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys'

Q: What is the severity of CVE-2023-7289?

CVE-2023-7289 has been classified as a high severity vulnerability.

Q: How do I fix CVE-2023-7289?

To fix CVE-2023-7289, update the Paytium: Mollie payment forms & donations plugin to version 4.4.0 or higher.

Q: What systems are affected by CVE-2023-7289?

CVE-2023-7289 affects versions of the Paytium plugin for WordPress up to and including 4.3.7.

Q: Who can exploit CVE-2023-7289?

Authenticated attackers can exploit CVE-2023-7289 to unauthorizedly update the API keys.

Q: What is the function involved in CVE-2023-7289?

The vulnerability in CVE-2023-7289 is due to a missing capability check in the paytium_sw_save_api_keys function.

Published Oct 16, 2024

Updated

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytiumswsaveapikeys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin API keys.

Affected Software

1 affected component

Paytium Paytium Wordpress<4.4.0

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0

Event History

Oct 16, 2024

CVE Published

via MITRE·06:43 AM

Data Sourced

via MITRE·06:43 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-7289?

CVE-2023-7289 has been classified as a high severity vulnerability.

How do I fix CVE-2023-7289?