CVE-2023-28121: 
WordPress vulnerability analysis and mitigation

An authentication bypass vulnerability (CVE-2023-28121) was discovered in the WooCommerce Payments plugin for WordPress affecting versions 5.6.1 and lower. The vulnerability, discovered on March 22, 2023, allows an unauthenticated attacker to send requests on behalf of an elevated user, such as an administrator, potentially leading to complete site takeover. The plugin, which has over 600,000 active installations, received a critical CVSS base score of 9.8 (NVD, Woo Advisory).

The vulnerability stems from an improper authentication mechanism in the Platform_Checkout_Session::init() function. The flaw allows unauthenticated attackers to create an admin account and take over the blog by sending specially crafted requests to the WordPress REST API endpoint. The vulnerability was assigned CWE-287 (Improper Authentication) and received a CVSS v3.1 base score of 9.8, indicating critical severity (WPScan, NVD).

Successful exploitation of this vulnerability allows remote, unauthenticated attackers to gain administrative access to affected WordPress sites. This could lead to complete site takeover, ability to impersonate arbitrary users including administrators, and potential compromise of sensitive data (FortiGuard).

The vulnerability was patched in version 5.6.2, released on March 23, 2023. WordPress.org's Plugin Team implemented auto-updates for affected versions. Site administrators should ensure they are running one of the patched versions (4.8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2, or later). Additionally, it is recommended to check for unexpected admin users or posts, update admin passwords, and rotate API keys (Woo Advisory).

WooCommerce immediately deactivated the impacted services and mitigated the issue for all websites hosted on WordPress.com, Pressable, and WPVIP upon discovery. The vulnerability was reported through their HackerOne program by Michael Mazzolini of GoldNetwork. The WooPay beta program was temporarily disabled as a precautionary measure (Woo Advisory).