CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.
Explanation of Vulnerability in Simple Terms
The EAN Barcode Generator for WooCommerce plugin through version 4.9.2 contains an authorization flaw that allows authenticated users with low privileges to access sensitive information they should not be able to view. The vulnerability requires a valid WordPress account but no special interaction. Site administrators should update to a version newer than 4.9.2 to close this access control gap.
What an attacker can do
Read sensitive data they don't have permission to access.
Potential impact on your site
Unauthorized users can view restricted information; data confidentiality is at risk.
Conditions required to exploit
Valid WordPress user account with low-level privileges; network access to the site.
Key dates
External resources
Related vulnerabilities
