CVE-2024-30477: Klarna WooCommerce Auth Bypass Flaw

CVE-2024-30477 Overview

CVE-2024-30477 is a Missing Authorization vulnerability (CWE-862) affecting the Klarna Payments for WooCommerce WordPress plugin. This broken access control flaw allows unauthenticated attackers to perform unauthorized actions that should require proper authentication and authorization checks. The vulnerability exists in versions up to and including 3.2.4 of the plugin.

Critical Impact

This vulnerability enables unauthorized access to sensitive functionality without authentication, potentially allowing attackers to manipulate payment processes, access customer data, or compromise the integrity of WooCommerce transactions.

Affected Products

• Klarna Payments for WooCommerce versions from n/a through 3.2.4
• WordPress sites running the vulnerable Klarna payment plugin
• WooCommerce installations with Klarna payment gateway enabled

Discovery Timeline

• 2024-03-29 - CVE-2024-30477 published to NVD
• 2025-04-15 - Last updated in NVD database

Technical Details for CVE-2024-30477

Vulnerability Analysis

The Missing Authorization vulnerability in Klarna Payments for WooCommerce represents a critical Broken Access Control flaw. The plugin fails to implement proper authorization checks on certain functionality, allowing unauthenticated users to access administrative or privileged operations. This type of vulnerability occurs when applications do not verify that a user has permission to perform a specific action before executing it.

In the context of a payment gateway plugin, missing authorization controls are particularly dangerous as they can expose sensitive payment workflows, customer information, and transaction management functionality to unauthorized parties.

Root Cause

The root cause is the absence of proper capability checks and nonce verification in one or more AJAX handlers or REST API endpoints within the plugin. WordPress plugins should implement current_user_can() checks and validate nonces to ensure that only authorized users can execute privileged operations. When these security controls are missing, any user—including unauthenticated visitors—can invoke sensitive functionality.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft malicious HTTP requests targeting the vulnerable endpoints within the Klarna Payments plugin. Since no authorization verification occurs, the attacker's requests are processed as if they came from a legitimate, authorized user.

The attack flow typically involves:

1. Identifying vulnerable AJAX actions or REST endpoints exposed by the plugin
2. Crafting requests that bypass missing authorization checks
3. Executing privileged operations such as modifying payment settings, accessing order data, or manipulating transaction states

For detailed technical analysis and exploitation patterns, refer to the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2024-30477

Indicators of Compromise

• Unexpected AJAX or REST API requests to Klarna plugin endpoints from unauthenticated sessions
• Unauthorized modifications to Klarna payment settings or configurations
• Unusual transaction patterns or order status changes without corresponding admin activity
• Web server logs showing repeated access to admin-ajax.php with Klarna-related actions from external IPs

Detection Strategies

• Monitor WordPress AJAX request logs for suspicious activity targeting Klarna payment endpoints
• Implement Web Application Firewall (WAF) rules to detect and block unauthorized access patterns
• Review plugin audit logs for configuration changes made without corresponding admin user sessions
• Deploy file integrity monitoring to detect unauthorized plugin modifications

Monitoring Recommendations

• Enable detailed access logging on WordPress installations with focus on payment plugin interactions
• Configure alerts for unauthorized access attempts to WooCommerce payment gateway settings
• Monitor for anomalous traffic patterns to the wp-admin/admin-ajax.php endpoint
• Implement real-time security monitoring for all payment-related plugin activities

How to Mitigate CVE-2024-30477

Immediate Actions Required

• Update Klarna Payments for WooCommerce to a version newer than 3.2.4 immediately
• Review recent transaction and order logs for any signs of unauthorized access or manipulation
• Audit current Klarna payment gateway settings to ensure no unauthorized modifications have been made
• Consider temporarily disabling the plugin if an update is not immediately available

Patch Information

Update the Klarna Payments for WooCommerce plugin to the latest available version that addresses this missing authorization vulnerability. The vulnerability affects all versions through 3.2.4, so ensure your installation is running a patched release. Check the WordPress plugin repository or the official Klarna developer resources for the latest secure version.

Workarounds

• Implement additional access controls at the web server level to restrict access to WordPress AJAX endpoints
• Deploy a Web Application Firewall (WAF) with rules to block unauthorized requests to payment plugin endpoints
• Restrict administrative access to trusted IP addresses where feasible
• Enable WordPress security plugins that provide additional authorization layer protection

# WordPress CLI command to check current plugin version
wp plugin list --name=klarna-payments-for-woocommerce --fields=name,version,status

# Update the plugin to the latest version
wp plugin update klarna-payments-for-woocommerce

# Verify the update was successful
wp plugin get klarna-payments-for-woocommerce --field=version