CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.
Explanation of Vulnerability in Simple Terms
The Omnisend Email Marketing for WooCommerce plugin through version 1.13.8 exposes sensitive information to unauthenticated attackers over the network. An attacker can retrieve data without needing to log in or interact with a site administrator. The vulnerability stems from insufficient access controls on data endpoints. Update to a version newer than 1.13.8 to resolve this issue.
What an attacker can do
Read sensitive data from the plugin without logging in.
Potential impact on your site
Customer or business data stored in the Omnisend plugin may be exposed to anyone on the internet.
Conditions required to exploit
Network access to the affected WooCommerce site; no authentication required.
Key dates
External resources
Related vulnerabilities
