CVE-2024-1492
Assigner: Wordfence
Published: 2024-02-20T18:56:29.589Z
State: PUBLISHED
affected: vendor: wpify
product: WPify Woo Czech
versions: version: *
status: affected
lessThanOrEqual: 4.0.8
versionType: semver
defaultStatus: unaffected
descriptions: value: The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function in all versions up to, and including, 4.0.8. This makes it possible for unauthenticated attackers to obtain shipping details for orders as long as the order number is known.
problemTypes: descriptions: description: CWE-284 Improper Access Control
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
credits: type: finder
value: Francesco Carlucci
timeline: time: 2024-02-19T00:00:00.000+00:00
value: Disclosed