WordPress Plugin Vulnerabilities

WooCommerce Canada Post Shipping < 2.8.4 - Unauthenticated Unauthorised Action

Description

The plugin does not have authorisation check in an action, which could allow unauthenticated users to perform an unauthorised action

Affects Plugins

Plugin icon
woocommerce-shipping-canada-post
Fixed in 2.8.4

References

CVE
CVE-2023-51498
URL
https://patchstack.com/database/vulnerability/woocommerce-shipping-canada-post/wordpress-woocommerce-canada-post-shipping-plugin-2-8-3-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
27c10b88-24eb-4dc3-8b41-2a7219c55132

Timeline

Publicly Published
2023-12-27 (about 2 years ago)
Added
2024-01-04 (about 2 years ago)
Last Updated
2024-01-04 (about 2 years ago)

Other

Published
Title
Published
2024-04-16
Title
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) < 3.1.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Published
2025-10-03
Title
WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder < 1.2.17 - Missing Authentication via wdkit_handle_review_submission Function
Published
2026-02-18
Title
Breeze – WordPress Cache Plugin < 2.2.22 - Missing Authorization to Cache Deletion
Published
2025-05-16
Title
CSS3 Compare Pricing Tables for WordPress < 11.7 - Missing Authorization
Published
2025-03-27
Title
RomethemeKit For Elementor < 1.5.5 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation