WordPress Plugin Vulnerabilities

ECPay Ecommerce for WooCommerce < 1.1.2502030 - Missing Authorization to Authenticated (Subscriber+) Log Deletion

Description

The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clear_ecpay_debug_log' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's log files.

Affects Plugins

Plugin icon
ecpay-ecommerce-for-woocommerce
Fixed in 1.1.2502030

References

CVE
CVE-2024-13652
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae08e0b-ea17-46c1-aad3-4ecea69c1bdc

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
incognito
Verified
No
WPVDB ID
25d5e06e-0a53-4ef3-a693-774494fb98c0

Timeline

Publicly Published
2025-01-30 (about 1 year ago)
Added
2025-01-30 (about 1 year ago)
Last Updated
2025-02-14 (about 1 year ago)

Other

Published
Title
Published
2024-02-27
Title
WP Private Content Plus < 3.6.1 - Unauthenticated Protected Post Access
Published
2025-07-03
Title
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action
Published
2025-01-30
Title
Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update
Published
2026-07-08
Title
Open Shop < 1.7.2 - Missing Authorization
Published
2026-01-10
Title
File Uploads Addon for WooCommerce < 1.7.4 - Missing Authorization