Unauthorized Order Modification in Yaad Sarig Payment Gateway For WC WordPress Plugin

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Yaad Sarig Payment Gateway For WC WordPress plugin. It allows any authenticated user, including low-privilege subscribers, to manipulate orders belonging to other customers without proper authorization checks. The plugin fails to verify if the requesting user owns the target order during payment-processing actions.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Yaad Sarig Payment Gateway For WC plugin. If it is below 2.2.13, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the version.

Useful 0 Not Useful 0

Impact Analysis

An attacker could alter or access orders belonging to other customers, potentially leading to unauthorized transactions, data leaks, or financial loss. Even non-privileged users like subscribers can exploit this to interfere with other users' orders.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing or allowing unauthorized access to personal and financial data of other users. It may also breach HIPAA if protected health information is involved, as unauthorized order alterations could compromise data integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Yaad Sarig Payment Gateway For WC plugin to version 2.2.13 or later immediately. Remove or disable the plugin if an update is not available. Review order logs for unauthorized changes.

Useful 0 Not Useful 0