CVE-2023-3365 MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

2023-08-0714:31:21

WPScan

www.cve.org

cve-2023-3365

multiparcels

woocommerce

arbitrary deletion

8.2 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.2%

JSON

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "MultiParcels Shipping For WooCommerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.14.14"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]