WooCommerce Ship to Multiple Addresses < 3.8.4 - Subscriber+ Shipping Address Disclosure via IDOR

2023-05-1500:00:00

wpscan.com

The plugin does not ensure that the order to display the shipping address from belong to the user making the request, allowing any authenticated users, such as subscriber to view other shipping addresses via an IDOR

PoC

https://example.com/checkout/shipping-addresses/?order_id=106

CPENameOperatorVersion
woocommerce-shipping-multiple-addresseslt3.8.4

CPE	Name	Operator	Version
	woocommerce-shipping-multiple-addresses	lt	3.8.4

References

patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-3-insecure-direct-object-references-idor-vulnerability

JSON

Related for WPVDB-ID:F5F566C7-B3CF-46BF-82BD-34208F8F7C5B