CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Order Tip for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_tips_to_csv() function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to export the plugin's order fees.
Explanation of Vulnerability in Simple Terms
The Order Tip for WooCommerce plugin through version 1.3.1 does not properly check user permissions before allowing access to sensitive data. An unauthenticated attacker can read tip information and other data without authorization. This affects all installations of the plugin up to and including version 1.3.1.
What an attacker can do
Read tip data and other sensitive information without logging in.
Potential impact on your site
Sensitive tip data may be exposed to unauthenticated visitors, potentially revealing customer or business information.
Conditions required to exploit
Network access to the WooCommerce site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
