CVE-2020-11497: woocommerce nab_transact
Vulnerability summary
CVE-2020-11497 is a high (CVSS 7.5) vulnerability in woocommerce nab_transact. EPSS estimates a 1.15% chance of exploitation in the next 30 days, higher than 66.6% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 2.1.2.
Timeline
- 26-08-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.15%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.15% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (themissinglink.com.au)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-354Improper Validation of Integrity Check ValueThe product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
- CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Affected systems
Woocommerce1 product
- nab_transact2.1.0
Wordpress1 product
- woocommerce-gateway-nab-dp< 2.1.2
2 vendors · 2 products
References
4 links- www.themissinglink.com.au/security-advisories-cve-2020-11497X Refsource MISCExploitThird Party Advisory
- packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.htmlX Refsource MISCThird Party Advisory