Tipsacarrier < 1.5.0.5 - Missing Authorization to Order Disclosure
2022-04-13 00:00
José AguileraStrategic Overview
StatusPatched in 1.5.0.5
Affected PluginTipsacarrier
Affected Version
< 1.5.0.5CVSS6.5Medium
CVE
CVE-2021-25002Vulnerability Overview
The Tipsacarrier WordPress plugin through 1.5.0.5 (not included) does not have any authorisation check in place in some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL
Technical Analysis
REMEDIATION: Update to version 1.5.0.5, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C