Unauthorized Data Access in WooCommerce Multivendor Marketplace by WCFM

CVE-2023-2275

What is CVE-2023-2275?

The WooCommerce Multivendor Marketplace – REST API plugin for WordPress suffers from an access control vulnerability due to inadequate capability checks on key functions such as 'get_item', 'get_order_notes', and 'add_order_note'. This security oversight allows authenticated users with subscriber roles or higher to gain unauthorized access to sensitive order details and notes, as well as to append additional notes to orders. This vulnerability affects versions through 1.5.3, posing a risk to data integrity and confidentiality in e-commerce environments.

References