Unauthorized Data Loss in ECPay Ecommerce for WooCommerce Plugin
CVE-2024-13652
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 30 January 2025
What is CVE-2024-13652?
The ECPay Ecommerce for WooCommerce plugin for WordPress is susceptible to unauthorized data loss due to a missing capability check in the 'clear_ecpay_debug_log' AJAX action. This flaw affects all versions up to and including 1.1.2411060. Authenticated attackers with Subscriber-level access can exploit this vulnerability to delete the plugin's log files, jeopardizing the integrity of the system.
Affected Version(s)
ECPay Ecommerce for WooCommerce * <= 1.1.2411060