CVE-2024-2382: CWE-345 Insufficient Verification of Data Authenticity in ishanverma Authorize.net Payment Gateway For WooCommerce
The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment.
AI Analysis
Technical Summary
CVE-2024-2382 is a vulnerability in the ishanverma Authorize.net Payment Gateway For WooCommerce plugin for WordPress. The issue arises from insufficient verification of data authenticity (CWE-345) when processing requests that update order payment statuses. This flaw enables unauthenticated attackers to manipulate order statuses to 'paid' without making any payment, effectively bypassing the payment process. The vulnerability affects all versions up to 8.0. There is no indication of known exploits in the wild or an available patch at this time.
Potential Impact
An attacker can update order payment statuses to 'paid' without completing any payment, potentially leading to unauthorized order fulfillment and financial loss for merchants using the affected plugin. The vulnerability does not impact confidentiality or availability but compromises the integrity of payment status data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or implementing additional verification controls at the application or network level to prevent unauthorized status updates.
CVE-2024-2382: CWE-345 Insufficient Verification of Data Authenticity in ishanverma Authorize.net Payment Gateway For WooCommerce
Description
The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-2382 is a vulnerability in the ishanverma Authorize.net Payment Gateway For WooCommerce plugin for WordPress. The issue arises from insufficient verification of data authenticity (CWE-345) when processing requests that update order payment statuses. This flaw enables unauthenticated attackers to manipulate order statuses to 'paid' without making any payment, effectively bypassing the payment process. The vulnerability affects all versions up to 8.0. There is no indication of known exploits in the wild or an available patch at this time.
Potential Impact
An attacker can update order payment statuses to 'paid' without completing any payment, potentially leading to unauthorized order fulfillment and financial loss for merchants using the affected plugin. The vulnerability does not impact confidentiality or availability but compromises the integrity of payment status data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or implementing additional verification controls at the application or network level to prevent unauthorized status updates.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-03-11T16:08:11.972Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6daeb7ef31ef0b58aaf7
Added to database: 2/25/2026, 9:46:22 PM
Last enriched: 4/9/2026, 2:01:13 PM
Last updated: 4/12/2026, 7:39:42 AM
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.