CVE-2023-6327
Assigner: Wordfence
Published: 2024-05-09T20:03:21.876Z
State: PUBLISHED
affected: vendor: devitemsllc
product: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)
versions: version: *
status: affected
lessThanOrEqual: 2.8.7
versionType: semver
defaultStatus: unaffected
descriptions: value: The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchased in the past week, along with the users that purchased them.
title: ShopLentor (formerly WooLentor)  <= 2.8.7 - Missing Authorization via purchased_new_products
problemTypes: descriptions: description: CWE-862 Missing Authorization
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
credits: type: finder
value: Francesco Carlucci
timeline: time: 2024-05-03T00:00:00.000+00:00
value: Disclosed