CVE-2023-6897 MEDIUM

CVE-2023-6897: EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode

Vendor Wpcodefactory
Product EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory
Weakness CWE-639 · IDOR
Published April 18, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.

Key dates

02Disclosure timeline

April 18, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0 CVE-2023-4099 Multiple vulnerabilities in IDM Sistemas QSige CVE-2025-27939 Growatt Cloud portal Authorization Bypass Through User-Controlled Key CVE-2026-22409 WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-14998 Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover