CVE-2023-28121

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	WooCommerce Payments WordPress Plugin	Fixed version 5.6.2

References

Timeline

Published: Apr 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-281227.8A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a malicious actor with loc CVE-2023-281235.5A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while CVE-2023-281245.5Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI Desktop CVE-2023-281255.9An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to CVE-2023-281265.9An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploitin CVE-2023-281277.5A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosu CVE-2023-281287.2An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t CVE-2023-281297.8DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installatio CVE-2023-28136.1All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPr CVE-2023-281307.2Local user may lead to privilege escalation using Gaia Portal hostnames page.CVE-2023-281319.6A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that confi CVE-2023-281337.8Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file