PT-2023-16978 · WordPress · Wp Simple Shopping Cart

Ayoub Safa · Published 2023-03-16 · Updated 2023-03-22 · CVE-2023-1431

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Simple Shopping Cart plugin for WordPress versions up to, and including, 4.6.3

Description The issue allows unauthenticated attackers to view sensitive information that should be limited to administrators only. This information can include first name, last name, email, address, IP Address, and more. The problem arises because the plugin saves shopping cart data exports in a publicly accessible location, specifically at the /wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/ endpoint.

Recommendations For WP Simple Shopping Cart plugin for WordPress versions up to, and including, 4.6.3, consider restricting access to the /wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/ endpoint until a patch is available. As a temporary workaround, avoid using the plugin's data export feature to minimize the risk of sensitive information exposure. Update to a version later than 4.6.3 when available.

Fix

Related Identifiers

CVE-2023-1431

Affected Products

Wp Simple Shopping Cart

References · 6

• https://osv.dev/vulnerability/CVE-2023-1431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1431 · Security Note
• https://t.me/cibsecurity/60131 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ea4453bc-557b-4abf-85c6-4aecfd8f4012?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2878855%40wordpress-simple-paypal-shopping-cart&new=2878855%40wordpress-simple-paypal-shopping-cart&sfp_email=&sfph_mail= · Note
• https://t.me/cvenotify/46681 · Telegram Post