PT-2024-39628 · WordPress · Get Quote For Woocommerce

Eduard Stehlík + 1 · Published 2024-10-30 · Updated 2024-11-01 · CVE-2024-9430

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress versions up to, and including, 1.0.0

Description The issue is related to unauthorized access of Quote data due to a missing capability check on the ct tepfw wp loaded function. This allows unauthenticated attackers to download Quote PDF and CSV documents.

Recommendations For versions up to, and including, 1.0.0, consider disabling the ct tepfw wp loaded function until a patch is available to prevent unauthorized access to Quote data.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-9430

Affected Products

Get Quote For Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-9430 · Security Note
• https://twitter.com/CVEnew/status/1851880483077959740 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4d0a0aa7-7bd9-4883-85b6-b7abf338aa75?source=cve · Note
• https://t.me/cvenotify/100131 · Telegram Post
• https://plugins.trac.wordpress.org/browser/get-a-quote-for-woocommerce/trunk/includes/admin/class-ct-rfq-admin.php · Note
• https://t.me/cvedetector/9491 · Telegram Post