CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ticket_content_callback' function in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to view any support ticket content, including sensitive customer information and private communications, by providing a ticket ID.
Explanation of Vulnerability in Simple Terms
The ilGhera Support System for WooCommerce versions 1.3.0 and earlier contain an authorization flaw that allows unauthenticated attackers to read sensitive information. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 1.3.0 to remediate the issue.
What an attacker can do
Read sensitive information from the support system without authentication.
Potential impact on your site
Confidential data stored in the support system may be exposed to unauthorized parties.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
