Unauthenticated Order Status Change in Livees Checkout WordPress Plugin

Executive Summary

The Livees Checkout WordPress plugin through version 7.0.2 lacks proper authorization checks on the order confirmation page. This allows unauthenticated users to modify order statuses, inject arbitrary data or notes into orders, and recover order keys by exploiting unvalidated request parameters.

Useful 0 Not Useful 0

Detection Guidance

Check if the Livees Checkout WordPress plugin version 6.8 to 7.0.2 is installed. Inspect network traffic for unauthorized POST requests to the order confirmation page modifying order statuses or injecting data.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to change order statuses, potentially leading to financial losses or order fulfillment issues. They could also inject malicious data into orders or steal order keys, which might enable further unauthorized actions or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive order data, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it may risk protected health information if orders contain such data, leading to compliance failures and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Livees Checkout plugin to the latest version if available. If no update exists, consider disabling the plugin until a patch is released. Monitor order logs for suspicious changes.

Useful 0 Not Useful 0