PT-2023-16569 · WordPress · Woocommerce Multiple Customer Addresses & Shipping

Johannes Ludwig + 2 · Published 2023-03-20 · Updated 2023-03-23 · CVE-2023-0865

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce Multiple Customer Addresses & Shipping WordPress plugin versions prior to 21.7

Description The issue allows any authenticated user to add, update, duplicate, delete, and retrieve addresses of other users, due to insufficient validation of user privileges. This affects users with low privileges, such as subscribers.

Recommendations For versions prior to 21.7, update to version 21.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the address management functionality to high-privilege users until the update is applied.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-0865

Affected Products

Woocommerce Multiple Customer Addresses & Shipping

References · 5

• 🔥 https://wpscan.com/vulnerability/e39c0171-ed4a-4143-9a31-c407e3555eec · Exploit
• https://osv.dev/vulnerability/CVE-2023-0865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0865 · Security Note
• https://t.me/cvenotify/46505 · Telegram Post
• https://t.me/cibsecurity/60339 · Telegram Post