PayU Plugin Panic: WordPress Sites Vulnerable to Account Hijacking!
PayU CommercePro users beware: a critical vulnerability lets attackers hijack WordPress accounts with a sneaky shipping cost API maneuver. Exploitation involves a hardcoded email and clever API calls. Despite a 30-day disclosure, no fix is in sight. Time to deactivate and delete, or risk a hostile takeover of your admin account!
Hot Take:
Looks like the PayU CommercePro plugin is playing a dangerous game of “Guess Who?” with WordPress accounts. Who knew granting admin access could be as easy as fetching shipping costs? It’s time to ship these vulnerabilities off to a deserted island.
Key Points:
- PayU CommercePro plugin vulnerability allows account hijacking on WordPress sites.
- Flaw located in the /payu/v1/get-shipping-cost API route.
- Vulnerability stems from unsafe handling of update_cart_data() function.
- Exploit involves generating an auth token with a hardcoded email.
- No patch released despite a 30-day disclosure window by PatchStack.
Already a member? Log in here