Lucene search

K
wpvulndbWpvulndbWPVDB-ID:08BDC440-44A6-4DC4-AE2F-A35960941185
HistoryMar 27, 2024 - 12:00 a.m.

WholesaleX < 1.3.2 - Sensitive Information Exposure via export_users

2024-03-2700:00:00
wpscan.com
6
wholesalex
woocommerce
wordpress
vulnerability
sensitive information exposure
export_users
authenticated attackers
admin dashboard
subscribers
woocommerce installed
contributors
sensitive data

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

Description The WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the ‘export_users’. This makes it possible for authenticated attackers, with access to the admin dashboard (Subscribers, though with WooCommerce installed this would be limited to contributors by default) to extract sensitive data including lists of users.

CPENameOperatorVersion
eq1.3.2

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

Related for WPVDB-ID:08BDC440-44A6-4DC4-AE2F-A35960941185