WP eCommerce <= 3.8.14.3 - Missing Authorization
2014-11-01 00:00
MICKAEL NADEAU (Sucuri)Strategic Overview
Vulnerability Overview
The WP eCommerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various functions called via AJAX actions and admin_init hooks in versions up to, and including, 3.8.14.3. This makes it possible for unauthenticated attackers to perform a plethora of actions like exporting sensitive user information, modifying the plugin's settings, and more.
Technical Analysis
REMEDIATION: Update to version 3.8.14.4, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C