CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attackers to retrieve debug infromation.
Explanation of Vulnerability in Simple Terms
The Web3 Crypto Payments by DePay plugin for WooCommerce versions 2.12.17 and earlier lack proper authorization checks. An unauthenticated attacker can read sensitive information by making direct requests to the plugin. No user interaction or special network access is required. Update to a version newer than 2.12.17.
What an attacker can do
Read sensitive information from the plugin without authentication.
Potential impact on your site
Sensitive data may be exposed to unauthenticated visitors without your knowledge.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
