Insufficient Restrictions in Sell-Downloads Plugin for WordPress
CVE-2015-9348

7.5HIGH

Key Information:

Vendor

Wordpress
Status
Sell Downloads
Vendor
CVE Published:
27 August 2019

What is CVE-2015-9348?

The Sell-Downloads plugin for WordPress versions before 1.0.8 exhibits insufficient restrictions that allow attackers to perform brute-force guessing attacks on purchase IDs. This vulnerability can enable unauthorized users to access sensitive purchase information, risking the integrity and security of e-commerce transactions. To protect against this threat, it is crucial for users to update to the latest version of the plugin and implement additional security measures.

References

https://wordpress.org/plugins/sell-downloads/#developers
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.