WooCommerce POS Plugin Vulnerable to Information Disclosure

CVE-2024-2384

What is CVE-2024-2384?

The WooCommerce POS plugin for WordPress exhibits a vulnerability that allows authenticated users with customer-level access to view potentially sensitive information about other users. This occurs due to inadequate verification of authentication and authorization processes, which can be exploited by leveraging valid order IDs. The affected versions extend up to and including 1.4.11, making it crucial for users to evaluate their installations and apply necessary security measures.

References