What’s Vulnerable › Vulnerabilities

CVE-2024-0629: 2Checkout Payment Gateway for WooCommerce <= 6.2 - Missing Authorization via sniff_ins

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-02 · updated 2026-06-17
• Weakness: CWE-862

Description

The 2Checkout Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sniff_ins function in all versions up to, and including, 6.2. This makes it possible for unauthenticated attackers to make changes to orders and mark them as paid.

Affected products

• nmedia 2Checkout Payment Gateway: through 6.2

References

• https://wordpress.org/plugins/woocommerce-2checkout-payment/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc6a4a5-b133-4ee1-a345-a7c812624b03?source=cve
• https://wordpress.org/plugins/woocommerce-2checkout-payment/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc6a4a5-b133-4ee1-a345-a7c812624b03?source=cve

Get alerted when CVE-2024-0629 or the next vulnerability affects your stack