CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via Shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including emails as well as hashed passwords of any user.
Explanation of Vulnerability in Simple Terms
The Customer Email Verification for WooCommerce plugin through version 2.9.4 exposes sensitive customer information to authenticated users with low privileges. An attacker with a low-privilege account can read data they should not have access to, such as customer email addresses or verification details. This affects WooCommerce sites using the plugin and requires an attacker to have a valid user account.
What an attacker can do
Read sensitive customer data including email addresses and verification information.
Potential impact on your site
Customer email addresses and verification data may be exposed to any authenticated user, risking privacy violations.
Conditions required to exploit
Attacker must have a low-privilege user account on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
