CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add, update, and delete shipper tracking settings.
Explanation of Vulnerability in Simple Terms
MIMO Woocommerce Order Tracking versions up to 1.0.2 lack proper authorization checks, allowing authenticated users to modify order tracking data they should not have access to. An attacker with a low-privilege account can alter tracking information for orders belonging to other customers. The vulnerability requires an active user account but no special interaction from victims.
What an attacker can do
Modify order tracking data for orders belonging to other customers.
Potential impact on your site
Customer order tracking information can be altered by unauthorized users, damaging trust and potentially disrupting order fulfillment workflows.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
