PT-2023-16978 · WordPress · Wp Simple Shopping Cart

Ayoub Safa · Publicado 2023-03-16 · Atualizado 2023-03-22 · CVE-2023-1431

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Simple Shopping Cart plugin for WordPress versions up to, and including, 4.6.3

Description The issue allows unauthenticated attackers to view sensitive information that should be limited to administrators only. This information can include first name, last name, email, address, IP Address, and more. The problem arises because the plugin saves shopping cart data exports in a publicly accessible location, specifically at the /wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/ endpoint.

Recommendations For WP Simple Shopping Cart plugin for WordPress versions up to, and including, 4.6.3, consider restricting access to the /wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/ endpoint until a patch is available. As a temporary workaround, avoid using the plugin's data export feature to minimize the risk of sensitive information exposure. Update to a version later than 4.6.3 when available.

Correção

Identificadores relacionados

CVE-2023-1431

Produtos afetados

Wp Simple Shopping Cart

Referências · 6

• https://t.me/cibsecurity/60131 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1431 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1431 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/ea4453bc-557b-4abf-85c6-4aecfd8f4012?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2878855%40wordpress-simple-paypal-shopping-cart&new=2878855%40wordpress-simple-paypal-shopping-cart&sfp_email=&sfph_mail= · Nota
• https://t.me/cvenotify/46681 · Publicação no Telegram