{"id":"CVE-2023-28121","aliases":["EUVD-2023-31832","GHSA-rw6j-4w4v-pm7m"],"status":"published","title":"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an...","description":"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.87448,"percentile":0.99758,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2023-04-12T00:00:00Z","modified":"2026-06-17T05:46:55Z","exploits":[{"source":"metasploit","id":"auxiliary/scanner/http/wp_woocommerce_payments_add_user","title":"Wordpress Plugin WooCommerce Payments Unauthenticated Admin Creation","type":"auxiliary","date":"2023-03-22","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_woocommerce_payments_add_user"},{"source":"nuclei","id":"CVE-2023-28121","title":"WooCommerce Payments - Unauthorized Admin Access","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28121.yaml"},{"source":"pocgithub","id":"0axz-tools/CVE-2023-28121","title":"0axz-tools/CVE-2023-28121","date":"2025-10-19","url":"https://github.com/0axz-tools/CVE-2023-28121"},{"source":"pocgithub","id":"1337nemojj/CVE-2023-28121","title":"1337nemojj/CVE-2023-28121","date":"2023-11-03","url":"https://github.com/1337nemojj/CVE-2023-28121"},{"source":"pocgithub","id":"Jenderal92/WP-CVE-2023-28121","title":"Jenderal92/WP-CVE-2023-28121","date":"2023-11-03","url":"https://github.com/Jenderal92/WP-CVE-2023-28121"},{"source":"pocgithub","id":"gbrsh/CVE-2023-28121","title":"gbrsh/CVE-2023-28121","date":"2023-03-30","url":"https://github.com/gbrsh/CVE-2023-28121"},{"source":"pocgithub","id":"im-hanzou/Mass-CVE-2023-28121","title":"im-hanzou/Mass-CVE-2023-28121","date":"2023-07-12","url":"https://github.com/im-hanzou/Mass-CVE-2023-28121"},{"source":"pocgithub","id":"luisdevpentest/CVE-2023-28121-WordPress-Privilege-Escalation","title":"luisdevpentest/CVE-2023-28121-WordPress-Privilege-Escalation","date":"2026-04-30","url":"https://github.com/luisdevpentest/CVE-2023-28121-WordPress-Privilege-Escalation"},{"source":"pocgithub","id":"rio128128/Mass-CVE-2023-28121-kdoec","title":"rio128128/Mass-CVE-2023-28121-kdoec","date":"2023-07-12","url":"https://github.com/rio128128/Mass-CVE-2023-28121-kdoec"},{"source":"pocgithub","id":"sug4r-wr41th/CVE-2023-28121","title":"sug4r-wr41th/CVE-2023-28121","date":"2025-04-12","url":"https://github.com/sug4r-wr41th/CVE-2023-28121"}],"products":[{"vendor":"automattic","product":"woocommerce_payments"},{"vendor":"automattic","product":"woopayments"}],"references":[{"url":"https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28121"},{"url":"https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know"},{"url":"https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce"},{"url":"https://github.com/advisories/GHSA-rw6j-4w4v-pm7m"}],"sources":{"cve":[{"id":"CVE-2023-28121","description":"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.","status":"published","published":"2023-04-12T00:00:00Z","modified":"2024-08-02T12:30:24.17Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-31832","description":"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.","status":"published","published":"2023-04-12T00:00:00Z","modified":"2024-08-02T12:30:24Z","updated_at":"2026-11-03T03:50:06.256765Z"}],"ghsa":[{"id":"GHSA-rw6j-4w4v-pm7m","title":"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an...","description":"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.","status":"published","published":"2023-04-12T21:30:18Z","modified":"2024-04-04T03:25:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:56:14.876837Z"}],"nvd":[{"id":"CVE-2023-28121","description":"An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.","status":"published","published":"2023-04-12T21:15:28.057Z","modified":"2026-06-17T05:46:55.107Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:55.652109Z"}]}}