Medium severity4.3NVD Advisory· Published Oct 20, 2023· Updated Jun 17, 2026

CVE-2023-4947

Description

The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update EAN numbers for orders.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Yanco/Woocommerce Ean Payment Gateway
cpe:2.3:a:yanco:woocommerce_ean_payment_gateway:*:*:*:*:*:wordpress:*:*
Range: <6.1.0
WordPress/Woocommerce Ean Payment Gatewayllm-fuzzy
Range: <=6.1.0

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/2760b183-3c15-4f0e-b72f-7c0333f9d4b6nvdThird Party Advisory
plugins.yanco.dk/product/woocommerce-ean-payment-gateway/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000