Unauthorized Access to Quote Data in Woocommerce Request A Quote Plugin

CVE-2024-9430

5.3MEDIUM

Key Information

Vendor: Woocommerce
Vendor: CVE Published:; 31 October 2024

Summary

The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capability check on the ct_tepfw_wp_loaded function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to download Quote PDF and CSV documents.

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Oct 31, 2024

Collectors

NVD Database