PT-2020-13023

CVE-2020-12070

·

Published

2020-04-24

·

Updated

2020-05-01

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Advanced Woo Search plugin versions through 1.99
Description The issue concerns a sensitive information disclosure problem. It occurs in every AJAX search request via the sql field to the includes/class-aws-search.php file.
Recommendations For Advanced Woo Search plugin versions through 1.99, consider disabling the AJAX search functionality until a patch is available. Restrict access to the includes/class-aws-search.php file to minimize the risk of exploitation. Avoid using the sql field in AJAX search requests until the issue is resolved.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Related identifiers
CVE-2020-12070
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com