CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.
Explanation of Vulnerability in Simple Terms
Credova Financial version 1.4.8 transmits sensitive data over unencrypted connections. An attacker on the network path between a user and the application can intercept and read this data. No authentication or user interaction is required for the attacker to perform the interception.
What an attacker can do
Intercept and read sensitive data transmitted by the application over the network.
Potential impact on your site
User data and credentials transmitted through this application can be exposed to network eavesdropping.
Conditions required to exploit
Network access to the communication path between user and application; no authentication required.
Key dates
External resources
