Automattic Vulnerabilities and Affected Products
Vulnerabilities associated with WooPayments – Fully Integrated Solution Built and Supported by Woo.
Products
Clear product- WooCommerce15 vulnerabilities
- Jetpack4 vulnerabilities
- Newspack Blocks4 vulnerabilities
- WooPayments – Fully Integrated Solution Built and Supported by Woo4 vulnerabilities
- WP Job Manager4 vulnerabilities
- Jetpack – WP Security, Backup, Speed, & Growth3 vulnerabilities
- mongoose3 vulnerabilities
- Newspack Newsletters3 vulnerabilities
- newspack_newsletters3 vulnerabilities
- automattic/mongoose2 vulnerabilities
- Sensei LMS2 vulnerabilities
- sensei_lms2 vulnerabilities
- WordPress2 vulnerabilities
- WP Job Manager - Resume Manager2 vulnerabilities
- wp_job_manager2 vulnerabilities
- activitypub1 vulnerability
- ChaosTheory1 vulnerability
- Crowdsignal Dashboard – Polls, Surveys & more1 vulnerability
- Crowdsignal Forms1 vulnerability
- Developer1 vulnerability
- GHActivity1 vulnerability
- Jetpack CRM1 vulnerability
- Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation1 vulnerability
- Jetpack Debug Tools1 vulnerability
- Limit Login Attempts1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-51503MEDIUM | WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2. CWE-639Dec 31, 2023 | CVSS5.9v3.1 | EPSS0.464% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-35915HIGH | WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL InjectionImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0. CWE-89Dec 20, 2023 | CVSS7.6v3.1 | EPSS0.673% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-35916HIGH | WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0. CWE-639Dec 20, 2023 | CVSS7.5v3.1 | EPSS0.565% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-49828MEDIUM | WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.4.2. CWE-79Dec 14, 2023 | CVSS6.5v3.1 | EPSS0.384% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |