Unauthorized Data Access in Woo Total Sales Plugin for WordPress

CVE-2024-1688

What is CVE-2024-1688?

The Woo Total Sales plugin for WordPress suffers from a vulnerability that permits unauthorized users to access sensitive sales data. This issue stems from a missing capability check in the get_orders_archive() function across all versions up to and including 3.1.4. As a result, unauthenticated attackers can exploit this flaw to retrieve confidential sales reports, posing significant risks to store owners. It is crucial to address this vulnerability promptly to safeguard your WordPress environment and maintain the integrity of your data.

References