Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure

2023-10-2700:00:00

wpscan.com

missing authorization

sensitive information exposure

woocommerce order

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

39.8%

JSON

Description The plugin does not properly validate authorization in calls to the parseRemoteRequest function allowing unauthenticated visitors with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata).

References

www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/soisy-pagamento-rateale/soisy-pagamento-rateale-601-missing-authorization-to-sensitive-information-exposure