CVE-2023-2179: unknown woocommerce order status change notifier Missing Authorization
Vulnerability summary
CVE-2023-2179 is a medium (CVSS 6.5) Missing Authorization vulnerability in unknown woocommerce order status change notifier. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 15-05-2023PublishedVulnerability first disclosed.
- 24-01-2025Last modifiedVulnerability information updated.
Description
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
Woocommerce1 product
Wordpress1 product
- woocommerce-order-status-change-notifier≤ 1.1.0
3 vendors · 3 products