CVE-2024-0432

The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_delete_card' function. This makes it possible for unauthenticated attackers to delete the default card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Configurations

Configuration 1 (hide)

cpe:2.3:a:fabrick:gestpay_for_woocommerce:*:*:*:*:*:wordpress:*:*

History

10 Feb 2025, 14:47

Type Values Removed Values Added
References () https://wordpress.org/plugins/wppdf/ - () https://wordpress.org/plugins/wppdf/ - Not Applicable
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/7561a71a-c3f0-45f1-8230-2c17cbeff916?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/7561a71a-c3f0-45f1-8230-2c17cbeff916?source=cve - Third Party Advisory
First Time Fabrick
Fabrick gestpay For Woocommerce
CWE CWE-352
CPE cpe:2.3:a:fabrick:gestpay_for_woocommerce:*:*:*:*:*:wordpress:*:*

21 Nov 2024, 08:46

Type Values Removed Values Added
References () https://wordpress.org/plugins/wppdf/ - () https://wordpress.org/plugins/wppdf/ -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/7561a71a-c3f0-45f1-8230-2c17cbeff916?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/7561a71a-c3f0-45f1-8230-2c17cbeff916?source=cve -
Summary
  • (es) El complemento Gestpay para WooCommerce para WordPress es vulnerable a la Cross-Site Request Forgery en todas las versiones hasta la 20221130 incluida. Esto se debe a una validación nonce faltante o incorrecta en la función 'ajax_delete_card'. Esto hace posible que atacantes no autenticados eliminen el token de tarjeta predeterminado de un usuario mediante una solicitud falsificada, siempre que puedan engañar al administrador del sitio para que realice una acción como hacer clic en un enlace.

28 Feb 2024, 09:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-28 09:15

Updated : 2025-02-10 14:47


NVD link : CVE-2024-0432

Mitre link : CVE-2024-0432

CVE.ORG link : CVE-2024-0432


JSON object : View

Products Affected

fabrick

  • gestpay_for_woocommerce
CWE
CWE-352

Cross-Site Request Forgery (CSRF)