WordPress Plugin Vulnerabilities

WooCommerce < 7.9 - Unauthenticated Sensitive Information Disclosure

Description

The plugin does not properly apply CORS on some of its API endpoints, allowing attackers to leak customers PII information.

Affects Plugins

Plugin icon
woocommerce
Fixed in 7.9

References

URL
https://hackerone.com/reports/2057736

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
osama-hamad
Verified
No
WPVDB ID
d1cec296-b5df-4cea-8c0d-d03a975cb6af

Timeline

Publicly Published
2023-09-11 (about 2 years ago)
Added
2023-09-11 (about 2 years ago)
Last Updated
2023-09-11 (about 2 years ago)

Other

Published
Title
Published
2024-08-15
Title
Relevanssi < 4.23.0 - Unauthenticated Information Exposure
Published
2024-08-28
Title
Premium SEO Pack – WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure
Published
2025-01-27
Title
Import and export users and customers < 1.27.13 - Unauthenticated Sensitive Information Disclosure
Published
2023-03-16
Title
WP Simple Shopping Cart 4.6.3 - Unauthenticated PII Disclosure
Published
2025-04-01
Title
AIO Performance Profiler, Monitor, Optimize, Compress & Debug <= 1.3 - Unauthenticated Sensitive Information Exposure