CVE-2020-11497

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-354

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/13Exploit, Mailing List, Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2020-11497Exploit, Third Party Advisory
http://packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/13Exploit, Mailing List, Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2020-11497Exploit, Third Party Advisory

Timeline

Published: Aug 26, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-114988.8Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of th CVE-2020-114996.1Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by CVE-2020-11507.8A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully ex CVE-2020-115007.5Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a sin CVE-2020-115017.4GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in CVE-2020-115039.8A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows an attacker to run a CVE-2020-115057.5An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before CVE-2020-115067.5An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure CVE-2020-115077.8An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner 8.0.3 could cause arbitrary code execution with SYSTEM privileges when a m CVE-2020-115085.4An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or re CVE-2020-115096.1An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arb CVE-2020-11517.0An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully e