CVE-2023-3525

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without payment.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jul 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-35269.6In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauth CVE-2023-35276.8A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with admini CVE-2023-35289.8A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of CVE-2023-35297.5A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the fil CVE-2023-352966.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability CVE-2023-352978.1Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability CVE-2023-352987.5HTTP.sys Denial of Service Vulnerability CVE-2023-352997.8Windows Common Log File System Driver Elevation of Privilege Vulnerability CVE-2023-353008.8Remote Procedure Call Runtime Remote Code Execution Vulnerability CVE-2023-353028.8Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability CVE-2023-353038.8USB Audio Class System Driver Remote Code Execution Vulnerability CVE-2023-353047.8Windows Kernel Elevation of Privilege Vulnerability