Critical severity9.8NVD Advisory· Published Apr 12, 2023· Updated Jun 17, 2026

CVE-2023-28121

Description

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WooCommerce/Payments plugindescription
WordPress/WooCommerce PayPal Paymentsllm-fuzzy
Range: <=5.6.1

Patches

Vulnerability mechanics

References

developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/nvdVendor Advisory
www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.070
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000