Sensitive Information Exposure in Oliver POS - WooCommerce Plugin by WordPress

CVE-2024-13513

Summary

The Oliver POS plugin for WooCommerce is susceptible to Sensitive Information Exposure due to its logging functionality, exposing critical data such as client tokens. These tokens enable unauthenticated attackers to manipulate user accounts by changing details like email addresses and account types. Threat actors can further exploit this vulnerability to reset account passwords, leading to potentially compromising entire websites. Although logging was disabled in version 2.4.2.3, existing log files could still harbor sensitive information, making these sites vulnerable.

References