CVE-2023-28121

Critical9.8 Published on Apr 12, 2023

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-287, CWE-287

Vendorsautomattic

Affected products

Vendors	Product	Versions
automattic	woocommerce payments	< 4.8.2
automattic	woopayments	< 5.6.2

Vulnerabilities

Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Attackers exploit Bricksforge flaw to upload files as PHP without login, risking site takeover. Update advised and check uploads for abuse.

Oct 12, 202611:01 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

CVE-2023-28121

Affected products

Related articles

Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Audience measurement