CVE-2021-25002 Tipsacarrier < 1.5.0.5 - Unauthenticated Orders Disclosure

2022-05-0216:05:29

CWE-862

WPScan

www.cve.org

0.003 Low

EPSS

Percentile

68.8%

JSON

The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL

CNA Affected

[
  {
    "product": "Tipsacarrier",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.0.5",
        "status": "affected",
        "version": "1.5.0.5",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/b14f476e-3124-4cbf-91b4-ae53c4dabd7c

0.003 Low

EPSS

Percentile

68.8%

JSON

Related for CVELIST:CVE-2021-25002