Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure

2023-10-2700:00:00

wpscan.com

missing authorization

sensitive information exposure

woocommerce order

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.8%

JSON

Description The plugin does not properly validate authorization in calls to the parseRemoteRequest function allowing unauthenticated visitors with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata).

References

www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/soisy-pagamento-rateale/soisy-pagamento-rateale-601-missing-authorization-to-sensitive-information-exposure