CVE-2023-0865

🗓️ 20 Mar 2023 15:52:15Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

WooCommerce Multiple Customer Addresses & Shipping plugin before 21.7 allows unauthorized users to manipulate addresses

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2023-0865	20 Mar 202321:04	–	circl
CNNVD	WordPress Plugin WooCommerce Multiple Customer Addresses & Shipping 安全漏洞	20 Mar 202300:00	–	cnnvd
Cvelist	CVE-2023-0865 WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR	20 Mar 202315:52	–	cvelist
EUVD	EUVD-2023-12862	3 Oct 202520:07	–	euvd
NVD	CVE-2023-0865	20 Mar 202316:15	–	nvd
Patchstack	WordPress WooCommerce Multiple Customer Addresses & Shipping Plugin < 21.7 is vulnerable to Insecure Direct Object References (IDOR)	21 Mar 202300:00	–	patchstack
Prion	Cross site request forgery (csrf)	20 Mar 202316:15	–	prion
RedhatCVE	CVE-2023-0865	23 May 202505:40	–	redhatcve
Vulnrichment	CVE-2023-0865 WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR	20 Mar 202315:52	–	vulnrichment
wpexploit	WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR	27 Feb 202300:00	–	wpexploit

NVD

Vulners

Node

woocommerce_multiple_customer_addresses_&_shipping_project woocommerce_multiple_customer_addresses_&_shippingRange<21.7wordpress

[
  {
    "vendor": "Unknown",
    "product": "WooCommerce Multiple Customer Addresses & Shipping",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "21.7"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/e39c0171-ed4a-4143-9a31-c407e3555eec

Parameter	Position	Path	Description	CWE
address_id	request body	wp-admin/admin-ajax.php	vulnerability: ability for authenticated users to retrieve another user's address via wcmca_get_address_by_id without proper authorization.	CWE-639
user_id	request body	wp-admin/admin-ajax.php	vulnerability: ability for authenticated users to retrieve another user's address via wcmca_get_address_by_id without proper authorization.	CWE-639
wcmca_delete_id	request body	wp-admin/admin-ajax.php	vulnerability: ability for authenticated users to delete another user's address via wcmca_delete_address without proper authorization.	CWE-639
wcmca_user_id	request body	wp-admin/admin-ajax.php	vulnerability: ability for authenticated users to delete another user's address via wcmca_delete_address without proper authorization.	CWE-639
wcmca_security_token	request body	wp-admin/admin-ajax.php	vulnerability: ability for authenticated users to delete another user's address via wcmca_delete_address without proper authorization.	CWE-639
(unspecified)	request body	wp-admin/admin-ajax.php	vulnerability: wcmca_save_new_address AJAX action can be used to add/update an address for an arbitrary user.	CWE-639

26 Feb 2025 15:15Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.8

EPSS0.07595

SSVC

CWE-639