CVE-2024-9927

7.2 highEPSS 0.5%

High (7.2) in wpovernight woocommerce order proposal. EPSS 0.5% chance of exploitation in the next 30 days.

The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is due to the improper implementation of allow_payment_without_login function. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to log in to WordPress as an arbitrary user account, including administrators.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2024-10-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wpovernight:woocommerce_order_proposal

References

https://wpovernight.com/downloads/woocommerce-order-proposal/
https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc993a4-6f65-4570-811c-13a80dbec064?source=cve

Check your stack JSON