WooCommerce < 4.7.0 - Arbitrary Order Status Disclosure via IDOR
Description
"The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action."
Proof of Concept
https://example.com/wp-admin/admin-ajax.php?action=fetch_order_status&order_id=XX
Affects Plugins
Fixed in version 4.7.0✓
References
Classification
Miscellaneous
Timeline
Publicly Published
2020-12-28 (about 10 months ago)
Added
2021-02-22 (about 8 months ago)
Last Updated
2021-02-23 (about 8 months ago)