PT-2023-12456 · Woocommerce · Advanced Shipment Tracking For Woocommerce
CVSS v3.1
9.9
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Advanced Shipment Tracking for WooCommerce versions up to 3.2.6
Description
The issue concerns the function
update shipment status email status fun in the Advanced Shipment Tracking for WooCommerce plugin, which is vulnerable to authenticated arbitrary options update. This allows attackers, including those at the customer level, to update any WordPress option in the database.Recommendations
For versions up to 3.2.6, update to a version later than 3.2.6, as version 3.2.5 does not fully address the issue.
Exploit
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Advanced Shipment Tracking For Woocommerce