https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T14:48:00.956888+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-12264 CVE-2024-12264 — PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation 2026-10-09T14:48:00.958054+00:00

Affected: payuplugin PayU CommercePro Plugin

The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly verifying a user's identity prior to setting the users ID and auth cookies. This makes it possible for unauthenticated attackers to create new administrative user accounts.