{"id":"CVE-2023-3525","state":"PUBLISHED","title":"The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and includin","description":"The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without payment.","publishedAt":"2023-07-12T04:38:43.519Z","updatedAt":"2025-02-05T19:41:35.254Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"Wordfence"},"assigner":"Wordfence","products":["wanderlustcodes Getnet Argentina para Woocommerce"],"affected":[{"vendor":"wanderlustcodes","product":"Getnet Argentina para Woocommerce","defaultStatus":"unaffected","versions":[{"version":"0.0.1","status":"affected","lessThanOrEqual":"0.0.4","versionType":"semver"}]}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/245e9117-ca63-458e-a094-60a759f5ec19?source=cve","https://www.youtube.com/watch?v=xTyWqh93AM0"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/3xxx/CVE-2023-3525.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-3525","state":"PUBLISHED","datePublished":"2023-07-12T04:38:43.519Z","dateUpdated":"2025-02-05T19:41:35.254Z","assignerShortName":"Wordfence","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateReserved":"2023-07-06T13:31:01.859Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without payment."}],"affected":[{"vendor":"wanderlustcodes","product":"Getnet Argentina para Woocommerce","defaultStatus":"unaffected","versions":[{"version":"0.0.1","status":"affected","lessThanOrEqual":"0.0.4","versionType":"semver"}]}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245e9117-ca63-458e-a094-60a759f5ec19?source=cve"},{"url":"https://www.youtube.com/watch?v=xTyWqh93AM0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-639 Authorization Bypass Through User-Controlled Key"}]}],"providerMetadata":{"shortName":"Wordfence","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateUpdated":"2023-07-12T04:38:43.519Z"},"credits":[{"lang":"en","type":"finder","value":"Kijam López"}],"timeline":[{"time":"2023-07-07T00:00:00.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245e9117-ca63-458e-a094-60a759f5ec19?source=cve","tags":["x_transferred"]},{"url":"https://www.youtube.com/watch?v=xTyWqh93AM0","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T06:55:03.594Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-05T18:38:34.966978Z","id":"CVE-2023-3525","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-05T19:41:35.254Z"}}]}}}