WooCommerce POS Plugin Vulnerable to Information Disclosure
CVE-2024-2384

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Wcpos – Point Of Sale (pos) Plugin For WooCommerce
Vendor
CVE Published:
20 March 2024

What is CVE-2024-2384?

The WooCommerce POS plugin for WordPress exhibits a vulnerability that allows authenticated users with customer-level access to view potentially sensitive information about other users. This occurs due to inadequate verification of authentication and authorization processes, which can be exploited by leveraging valid order IDs. The affected versions extend up to and including 1.4.11, making it crucial for users to evaluate their installations and apply necessary security measures.

Affected Version(s)

WCPOS – Point of Sale (POS) plugin for WooCommerce 0 <= 1.4.11

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.