Unauthorized Data Modification in MIMO WooCommerce Order Tracking Plugin for WordPress

CVE-2024-5769

Summary

The MIMO WooCommerce Order Tracking plugin for WordPress has a vulnerability that allows authenticated attackers with Subscriber-level access and above to modify shipper tracking settings. This issue arises due to a lack of proper capability checks on several critical functions within the plugin. As a result, malicious users can add, update, or delete tracking information, potentially leading to misinformation or disruption of order tracking functionality.

References