WordPress Plugin Vulnerabilities
WooCommerce Email Test 1.5 - Order Information Disclosure
Description
When this plugin is installed, any anonymous user can open this url
https://www.domainname.de/?woocommerce_email_test=WC_Email_Customer_Completed_Order
..which shows the last (most recent) order along with all customer details, email address and cart content.
This is a severe security/data privacy breach and unlawful in (at least) germany.
Proof of Concept
Affects Plugins
Fixed in 1.6 References
Miscellaneous
Submitter
jansass GmbH
Submitter website
Verified
No
WPVDB ID
Timeline
Publicly Published
2016-12-08 (about 9 years ago)
Added
2016-12-09 (about 9 years ago)
Last Updated
2019-11-01 (about 6 years ago)
WPScan 