PT-2025-12323 · WordPress · Np Quote Request For Woocommerce

Tim Coen · Published 2025-03-20 · Updated 2025-03-27 · CVE-2024-13558

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NP Quote Request for WooCommerce plugin for WordPress versions up to, and including, 1.9.179

Description The issue is related to Insecure Direct Object Reference due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the content of quote requests.

Recommendations For versions up to, and including, 1.9.179, update to a version that includes the necessary validation to prevent Insecure Direct Object Reference attacks. As a temporary workaround, consider restricting access to quote requests to prevent unauthorized reading of their content.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-13558

Affected Products

Np Quote Request For Woocommerce

References · 13

• https://plugins.trac.wordpress.org/changeset/3256816 · Patch
• https://osv.dev/vulnerability/CVE-2024-13558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13558 · Security Note
• https://t.me/cvedetector/20736 · Telegram Post
• https://wordpress.org/plugins/woo-rfq-for-woocommerce/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5991c86b-6785-41a6-a5df-c65e8a28201c?source=cve · Note
• https://t.me/cvenotify/115455 · Telegram Post
• https://twitter.com/cybercronai/status/1902914392443724197 · Twitter Post
• https://twitter.com/CVEnew/status/1902968834254049740 · Twitter Post
• https://twitter.com/vulns_space/status/1902705068882981236 · Twitter Post
• https://t.me/cvenotify/116510 · Telegram Post
• https://twitter.com/cracbot/status/1904488520254951656 · Twitter Post
• https://t.me/cvetracker/19531 · Telegram Post