WordPress security changelog
MEDIUM CVE-2024-5861 Modified

WP EasyPay – Square for: A security weakness

WP EasyPay – Square for is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com
NVD score 6.5 CVSS 3.1 · nvd@nist.gov
Component
WP EasyPay – Square for
Plugin slug
wp-easy-pay
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Jul 24, 2024
Weakness
CWE-862 — Missing Authorization

This CVE was published Jul 24, 2024 and is one of 8 known issues for this plugin.

What to do

Patch or disable the affected component.

Update WP EasyPay – Square for to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

Primary and upstream sources