Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbWpvulndbWPVDB-ID:09CE3ADE-80FC-438B-8976-852A273D7C53
HistoryJun 13, 2023 - 12:00 a.m.

WooCommerce Stripe Payment Gateway < 7.4.1 - Unauthenticated PII Disclosure via IDOR

2023-06-1300:00:00
wpscan.com
17
woocommerce
unauthenticated access
sensitive information
order details

0.001 Low

EPSS

Percentile

47.1%

JSON

The plugin does not ensure that the order details to be displayed belongs to the user making the request, allows unauthenticated users to access sensitive information about the reorder details such as first/last names, email and address

PoC

As unauthenticated, see the source of https://example.com/?pay_for_order=true&amp;order-pay;=80 (80 being a valid order number)

CPENameOperatorVersion
woocommerce-gateway-stripelt7.4.1

Related

thn 1
cve 1
prion 1
openvas 1
cvelist 1
nvd 1
wpexploit 1
wordfence 1
thn
thn
Critical Security Vulnerability Discovered in WooCommerce Stripe Gateway Plugin
2023-06-14 08:33:00
cve
cve
CVE-2023-34000
2023-06-14 08:15:09
prion
prion
Design/Logic Flaw
2023-06-14 08:15:00
openvas
openvas
WordPress WooCommerce Stripe Payment Gateway Plugin < 7.4.1 IDOR Vulnerability
2023-06-21 00:00:00
cvelist
cvelist
CVE-2023-34000 WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)
2023-06-14 07:30:11
nvd
nvd
CVE-2023-34000
2023-06-14 08:15:09
wpexploit
wpexploit
WooCommerce Stripe Payment Gateway < 7.4.1 - Unauthenticated PII Disclosure via IDOR
2023-06-13 00:00:00
wordfence
wordfence
Wordfence Intelligence Weekly WordPress Vulnerability Report (June 12, 2023 to June 18, 2023)
2023-06-22 13:11:25

0.001 Low

EPSS

Percentile

47.1%

JSON
Related for WPVDB-ID:09CE3ADE-80FC-438B-8976-852A273D7C53
thn1cve1prion1openvas1cvelist1nvd1wpexploit1wordfence1