CVEvulnerability
CVE-2020-11497
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-08-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-354
Description
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.
Affected configurations
• woocommerce nab transact 2.1.0
Related
Weakness · CWE (1)
- CWE-354 Improper Validation of Integrity Check Value weakness
References
- http://packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.html Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Aug/13 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Aug/13 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Aug/13 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Aug/13 Exploit, Mailing List, Third Party Advisory
- https://www.themissinglink.com.au/security-advisories-cve-2020-11497 Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.html Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Aug/13 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Aug/13 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Aug/13 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Aug/13 Exploit, Mailing List, Third Party Advisory
- https://www.themissinglink.com.au/security-advisories-cve-2020-11497 Exploit, Third Party Advisory