CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.
Explanation of Vulnerability in Simple Terms
The WooCommerce Orders & Customers Exporter plugin through version 5.4 lacks proper authorization checks on export functionality. A logged-in user with low privileges can access and export sensitive order and customer data without appropriate permission validation. This allows unauthorized data disclosure to users who should not have access to this information.
What an attacker can do
Export sensitive order and customer data without proper authorization.
Potential impact on your site
Customer and order data can be accessed by unauthorized users, risking privacy violations and data breach liability.
Conditions required to exploit
Attacker must have a low-privilege account on the WordPress site (e.g., subscriber or contributor).
Key dates
External resources
