CVE-2023-4948: 
WordPress vulnerability analysis and mitigation

The WooCommerce CVR Payment Gateway plugin for WordPress contains a vulnerability (CVE-2023-4948) discovered in versions up to 6.1.0. The vulnerability stems from a missing capability check on the refreshordercvr_data AJAX action, which allows authenticated attackers with contributor-level access or higher to modify CVR numbers for orders without proper authorization (Wordfence).

The vulnerability is classified with a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The security issue stems from improper authorization controls in the plugin's AJAX functionality, specifically in the refreshordercvr_data action (NVD).

The vulnerability allows authenticated users with contributor-level permissions or higher to modify CVR (Danish business registration) numbers associated with orders in the WooCommerce system. This unauthorized modification capability could potentially be exploited to manipulate order information and affect business operations (Wordfence).

Users should upgrade to a version newer than 6.1.0 of the WooCommerce CVR Payment Gateway plugin to address this vulnerability (Plugin Page).