A critical authorization bypass vulnerability in the Payment Plugins Braintree For WooCommerce plugin allows unauthenticated attackers to exfiltrate payment tokens and potentially facilitate fraudulent charges.

The plugin fails to perform a capability check on the wc-braintree/v1/3ds/vaulted_nonce REST API endpoint, allowing unauthenticated users to access payment tokens without verifying ownership.

This vulnerability poses a significant risk to customer financial data and business integrity. By retrieving payment method nonces, unauthorized actors can potentially initiate fraudulent transactions or manipulate customer subscriptions, leading to direct financial loss and severe reputational damage. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to protect sensitive customer payment information.

Immediate Action: Review the official vendor advisory for the release of a patched version and update the plugin immediately upon availability. If no patch is currently available, consider temporarily deactivating the plugin until a secure update is provided.

Proactive Monitoring: Monitor server access logs for suspicious, repeated requests directed toward the wc-braintree/v1/3ds/vaulted_nonce endpoint, which may indicate automated scanning or exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized traffic to the REST API endpoint associated with the Braintree plugin until the software is updated.

Public Exploit Available: Unknown

Given the high-severity nature of this vulnerability and the potential for direct financial impact, organizations using the Braintree For WooCommerce plugin must prioritize this issue. Administrators should monitor the vendor's repository for a security update and apply it immediately to remediate the authorization bypass. Until a patch is deployed, restricting access to the affected API endpoint or deactivating the plugin is strongly recommended to prevent unauthorized data exfiltration.