CVE-2025-26657

CVE-2025-26657 is an information-disclosure vulnerability in SAP KMC WPC. An unauthenticated attacker can remotely retrieve usernames via a simple parameter query, exposing sensitive information and causing low confidentiality impact. The root cause is an information-disclosure flaw in the WPC co...

CVE-2025-26657 Information Disclosure vulnerability in SAP KMC WPC

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability...

CVE-2025-26657 Information Disclosure vulnerability in SAP KMC WPC

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability...

PT-2025-15366 · Sap · Sap Kmc Wpc

Name of the Vulnerable Software and Affected Versions: SAP KMC WPC affected versions not specified Description: The issue allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query, potentially exposing sensitive information and causing low impact on the...

CVE-2025-30825 WordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerability

Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through = 1.3.5...

CVE-2025-30825

CVE-2025-30825 affects WPC Smart Linked Products – Upsells & Cross-sells for WooCommerce. It is a Missing Authorization vulnerability enabling Privilege Escalation, impacting versions up to 1.3.5. CVSS v3.1 base score 8.8 (HIGH). Connected docs indicate a patched fix in a later release (Patch Sta...

PT-2025-14393 · Woocommerce · Wpc Smart Linked Products - Upsells & Cross-Sells For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce versions 1.3.5 and earlier Description: The issue is related to a Missing Authorization vulnerability that allows Privilege Escalation. This vulnerability affects the WPC Smart...

Exploit for CVE-2025-30772

🚨 CVE-2025-30772 - Privilege Escalation in WPC Smart Upsell Fu...

WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

Arbitrary Option Update to Privilege Escalation vulnerability discovered by LVT-tholv2k in WordPress Plugin WPC Smart Upsell Funnel for WooCommerce versions = 3.0.4...

CVE-2025-30772 WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through = 3.0.4...

PT-2025-13058 · Woocommerce · Wpc Smart Upsell Funnel

Name of the Vulnerable Software and Affected Versions: WPC Smart Upsell Funnel for WooCommerce versions 3.0.4 and earlier Description: The issue is related to a Missing Authorization vulnerability that allows Privilege Escalation in WPC Smart Upsell Funnel for WooCommerce. This vulnerability can ...

CVE-2024-12432

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generatekey' function not producing a sufficiently random value. This makes it possible for authenticated...

CVE-2024-50416

Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through = 1.2.6...

CVE-2024-10436

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the getconditionvalue function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute...

CVE-2024-12432 WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generatekey' function not producing a sufficiently random value. This makes it possible for authenticated...

CVE-2024-12432

The CVE-2024-12432 entry concerns the WPC Shop as a Customer for WooCommerce WordPress plugin, where the generate_key function produces a insufficiently random key, enabling authenticated attackers with Subscriber+ privileges to login as administrators via ajax_login. Affected versions go up to 1...

CVE-2024-12432 WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generatekey' function not producing a sufficiently random value. This makes it possible for authenticated...

WordPress plugin WPC Shop as a Customer for WooCommerce 安全特征问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security feature...

WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key vulnerability

Authentication Bypass Due to Insufficiently Unique Key vulnerability discovered by Thanh Nam Tran in WordPress Plugin WPC Shop as a Customer for WooCommerce versions = 1.2.8...

CVE-2024-12004

The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the ajaxupdateordernote function. This makes it possible for unauthenticated attackers to injec...