exploitDog

CVE-2024-1686

Опубликовано: 27 фев. 2024

Источник: nvd

CVSS3: 5.3

CVSS3: 6.5

EPSS Низкий

Описание

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:villatheme:woocommerce_thank_you_page_customizer:*:*:*:*:free:wordpress:*:*

Версия до 1.1.3 (исключая)

EPSS

Процентиль: 58%

0.00372

Низкий

5.3 Medium

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-862

Связанные уязвимости

GHSA-2r3p-7g4x-2m8x

CVSS3: 5.3

github

почти 2 года назад

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII.

EPSS

Процентиль: 58%

0.00372

Низкий

5.3 Medium

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-862