Sensitive Information Exposure in HT Mega Plugin for WordPress by Absolute Addons
CVE-2023-6214

7.5HIGH

Key Information:

Vendor
Wordpress
Vendor
CVE Published:
2 May 2024

Summary

The HT Mega – Absolute Addons For Elementor plugin for WordPress introduces a vulnerability that exposes sensitive information due to improper access controls in the purchased_products function. This weakness allows unauthenticated attackers to retrieve sensitive data, including order details and personally identifiable information (PII) of customers, from the past seven days. Webmasters and site administrators using this plugin should take immediate action to secure their installations to prevent unauthorized data access.

Affected Version(s)

HT Mega – Absolute Addons For Elementor * <= 2.4.6

References

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.
🍪 This website uses cookies, like every other website on the internet 😕 By using our website, you consent to the use of cookies.