CVE-2013-4594

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-10-25 · updated 2026-06-16
Weakness: CWE-287

Description

The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.

Affected products

Payment For Webform Project Payment For Webform: 7.x-1.0, 7.x-1.1, 7.x-1.2, 7.x-1.3, 7.x-1.4, 7.x-1.5

References

http://seclists.org/oss-sec/2013/q4/317
http://secunia.com/advisories/55431
https://drupal.org/node/2128345
https://drupal.org/node/2129373
http://seclists.org/oss-sec/2013/q4/317
http://secunia.com/advisories/55431
https://drupal.org/node/2128345
https://drupal.org/node/2129373

Get alerted when CVE-2013-4594 or the next vulnerability affects your stack