WordPress Plugin Vulnerabilities

WholesaleX < 1.3.2 - Sensitive Information Exposure via export_users

Description

The WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the 'export_users'. This makes it possible for authenticated attackers, with access to the admin dashboard (Subscribers, though with WooCommerce installed this would be limited to contributors by default) to extract sensitive data including lists of users.

Affects Plugins

Fixed in 1.3.2

References

Classification

Type
SENSITIVE DATA DISCLOSURE
CWE

Miscellaneous

Original Researcher
Emili Castells
Verified
No

Timeline

Publicly Published
2024-03-26 (about 2 years ago)
Added
2024-03-27 (about 2 years ago)
Last Updated
2024-03-27 (about 2 years ago)

Other