Syncee - Global Dropshipping < 1.0.10 - Authentication Token Disclosure

Proof of Concept

The plugin sends a GET request to "/wp-json/syncee/retailer/v1/getDataForFrontend" endpoint to get access token of the administrator. An attacker can use this access token to takeover the administrator's Syncee account via adding new team member.