CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Mykola Lukin Orders Chat for WooCommerce orders-chat-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orders Chat for WooCommerce: from n/a through <= 1.2.0.
Explanation of Vulnerability in Simple Terms
Orders Chat for WooCommerce versions 1.2.0 and earlier lack proper authorization checks, allowing authenticated users to access chat data they should not be able to view. An attacker with a low-privilege account can read sensitive chat messages and order information belonging to other users or orders. Update to a version newer than 1.2.0 to resolve this issue.
What an attacker can do
Read chat messages and order data belonging to other users or orders.
Potential impact on your site
Customer chat conversations and order details may be exposed to unauthorized users with site accounts.
Conditions required to exploit
Attacker must have a valid low-privilege account on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
