CVE-2024-25922

The Peach Payments Gateway plugin for WordPress versions up to 3.1.9 suffers from a missing authorization vulnerability. This broken access control issue arises because certain functions lack proper authorization, authentication, or nonce token checks, allowing unprivileged users to execute actions intended for higher privileged roles [1].

Attackers can exploit this vulnerability remotely without needing special access, as the missing checks enable any user to trigger privileged functions. The vulnerability is known to be used in mass-exploit campaigns, targeting thousands of websites regardless of their size or popularity [1].

The impact of successful exploitation includes the ability to perform unauthorized actions, potentially leading to site compromise or data manipulation. While the CVSS score (5.4) indicates medium severity, the vendor considers it low risk, but active exploitation is a concern [1].

To mitigate this issue, users must update the plugin to version 3.2.0 or later, which contains the fix. Patchstack users can enable auto-updates for vulnerable plugins. If an immediate update is not possible, contacting a hosting provider or web developer for assistance is recommended [1].