WordPress Plugin Vulnerabilities

HT Mega < 2.4.7 - Unauthenticated Order Data Disclosure

Description

The plugin is vulnerable to Sensitive Information Exposure via the purchased_products function, allowing unauthenticatied attackers to extract sensitive data including the previous 7 days of order data including products and customer PII.

Affects Plugins

Plugin icon
ht-mega-for-elementor
Fixed in 2.4.7

References

CVE
CVE-2023-6214
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/54043c6a-48a1-48e8-ba61-a7e8a1773036

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Francesco Carlucci
Verified
No
WPVDB ID
65c325d1-5c39-45f1-975e-e89fe4e7b83f

Timeline

Publicly Published
2024-04-16 (about 2 years ago)
Added
2024-04-17 (about 2 years ago)
Last Updated
2024-04-17 (about 2 years ago)

Other

Published
Title
Published
2026-07-23
Title
Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
Published
2025-11-10
Title
Authors List < 2.0.6.2 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode
Published
2024-06-06
Title
Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 2.6.12 - Authenticated (Subscriber+) Information Exposure
Published
2024-10-11
Title
Elementor Addon Elements < 1.13.9 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections
Published
2026-10-05
Title
SiteVault – Backup, Restore, Migration & Cloning < 1.5.18 - Unauthenticated Information Exposure