CVE-2024-1492

MEDIUM

WPify Woo Czech <= 4.0.8 - Unauthenticated Unauthorized Data Access via maybe_send_to_packeta Function

Title source: llm

Description

The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function in all versions up to, and including, 4.0.8. This makes it possible for unauthenticated attackers to obtain shipping details for orders as long as the order number is known.

References (2)

Core 2

Core References

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037482%40wpify-woo%2Ftrunk&old=3028980%40wpify-woo%2Ftrunk&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/44f691f2-b3f4-49b7-8710-015b5b11db18?source=cve

Scores

CVSS v3 5.3

EPSS 0.0046

EPSS Percentile 36.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-284 CWE-862

Status published

Products (2)

wpify/woo_czech < 4.0.9

wpify/WPify Woo Czech < 4.0.8

Published Feb 29, 2024

Tracked Since Feb 18, 2026