CVE-2023-7294: Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile'

Q: What is the severity of CVE-2023-7294?

CVE-2023-7294 has been rated as a high severity vulnerability due to its potential for unauthorized data modification.

Q: How can I fix CVE-2023-7294?

To fix CVE-2023-7294, update the Paytium plugin to version 4.4.0 or later, where the vulnerability is addressed.

Q: Who is affected by CVE-2023-7294?

CVE-2023-7294 affects all WordPress sites using versions of the Paytium plugin up to and including 4.3.7.

Q: What type of attack does CVE-2023-7294 enable?

CVE-2023-7294 allows authenticated attackers to perform unauthorized data modifications due to a missing capability check.

Q: Is there a patch available for CVE-2023-7294?

Yes, a patch for CVE-2023-7294 is available in Paytium plugin version 4.4.0 and later.

Published Oct 16, 2024

Updated

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the createmollieprofile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to create a mollie payment profile.

Affected Software

1 affected component

Paytium Paytium Wordpress<4.4.0

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0

Event History

Oct 16, 2024

CVE Published

via MITRE·06:43 AM

Data Sourced

via MITRE·06:43 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-7294?

CVE-2023-7294 has been rated as a high severity vulnerability due to its potential for unauthorized data modification.

How can I fix CVE-2023-7294?