PT-2024-18090 · WordPress · Wpify Woo Czech

Francesco Carlucci · Published 2024-02-20 · Updated 2024-03-08 · CVE-2024-1492

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WPify Woo Czech plugin versions up to, and including, 4.0.8

Description The issue allows unauthorized access to data due to a missing capability check on the maybe send to packeta function. This makes it possible for unauthenticated attackers to obtain shipping details for orders as long as the order number is known.

Recommendations For WPify Woo Czech plugin versions up to, and including, 4.0.8, update to a version higher than 4.0.8 to resolve the issue. As a temporary workaround, consider disabling the maybe send to packeta function until a patch is available.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2024-1492

Affected Products

Wpify Woo Czech

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-1492 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037482%40wpify-woo%2Ftrunk&old=3028980%40wpify-woo%2Ftrunk&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2024-1492 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/44f691f2-b3f4-49b7-8710-015b5b11db18?source=cve · Note
• https://twitter.com/CVEnew/status/1760025915307028921 · Twitter Post
• https://twitter.com/Esparta6108713/status/1766085047562444888 · Twitter Post