CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.
Explanation of Vulnerability in Simple Terms
WPC Smart Quick View for WooCommerce versions up to 4.2.5 contain an authorization flaw that allows unauthenticated attackers to read sensitive information. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 4.2.5 to remediate the issue.
What an attacker can do
Read sensitive information from the site without authentication.
Potential impact on your site
Unauthorized users can access sensitive data exposed by the plugin.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
