CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiShipping: from n/a through 2.3.5.
Explanation of Vulnerability in Simple Terms
WCMultiShipping for WooCommerce fails to properly check user permissions before allowing access to sensitive shipping and order data. An authenticated user with low privileges can read information they should not have access to. The vulnerability affects versions up to 2.3.5. Update to a version newer than 2.3.5 to resolve this issue.
What an attacker can do
Read shipping and order data belonging to other users or restricted areas of the site.
Potential impact on your site
Customer order details, shipping information, and potentially payment data may be exposed to other logged-in users.
Conditions required to exploit
Attacker must have a low-privilege account on the WooCommerce site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
