Chronopost & Mondial relay pour WooCommerce - WCMultiShipping <= 2.3.7 - Incorrect Authorization
2023-11-28 00:00
AnonymousStrategic Overview
StatusPatched in 2.3.8
Affected Version
<= 2.3.7CVSS5.3Medium
CVE
N/AVulnerability Overview
The UPS, Mondial Relay & Chronopost for WooCommerce – WCMultiShipping plugin for WordPress is vulnerable to unauthorized access of data due to an incorrect capability check on the wms_chronopost_test_credentials_ajax() function in all versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to test account credentials.
Technical Analysis
REMEDIATION: Update to version 2.3.8, or a newer patched version --- IDENTIFIER: CWE-863 (Incorrect Authorization) The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C