CVE-2024-4213 | THREATINT

Assigner	Wordfence
Reserved	2024-04-25
Published	2024-05-10
Updated	2024-08-01

Description

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the order report functionality. This makes it possible for unauthenticated attackers to extract sensitive data including order details such as payment details, addresses and other PII.

MEDIUM: 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-922 Insecure Storage of Sensitive Information

Product status

Default status

unaffected

affected

Timeline

2024-05-10:

Disclosed

Credits

rajesh patil 0x4005cd2750

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/93daab72-1243-4a05-91d3-9254a1aac727?source=cve

https://plugins.trac.wordpress.org/changeset/3084202/wp-easycart/trunk/admin/inc/wp_easycart_admin.php?old=3068711&old_path=wp-easycart%2Ftrunk%2Fadmin%2Finc%2Fwp_easycart_admin.php

cve.org CVE-2024-4213

nvd.nist.gov CVE-2024-4213

Download JSON