Описание
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
EPSS
Процентиль: 12%
0.00218
Низкий
2.7 Low
CVSS3
Дефекты
CWE-639
Связанные уязвимости
CVSS3: 2.7
github
9 дней назад
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
EPSS
Процентиль: 12%
0.00218
Низкий
2.7 Low
CVSS3
Дефекты
CWE-639