WordPress Plugin Vulnerabilities

BigCommerce <= 5.1.2 - Unauthenticated Sensitive Information Exposure

Description

The plugin is vulnerable to Sensitive Information Exposure via Log File, allowing unauthenticated attackers to extract sensitive data.

Affects Plugins

Plugin icon
bigcommerce
No known fix

References

CVE
CVE-2023-49162
URL
https://patchstack.com/database/vulnerability/bigcommerce/wordpress-bigcommerce-for-wordpress-plugin-5-0-6-sensitive-data-exposure-via-log-file-vulnerability

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Joshua Chan
Verified
No
WPVDB ID
f46489ff-0c8d-47fe-bdfe-4b6f9ada826d

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2023-12-08 (about 2 years ago)
Last Updated
2024-12-20 (about 1 year ago)

Other

Published
Title
Published
2020-07-30
Title
JetBackup < 1.4.1 - Subscriber+ Sensitive Information Disclosure
Published
2023-09-25
Title
WP Job Openings < 3.4.3 - Sensitive Data Exposure via Directory Listing
Published
2024-05-21
Title
NextScripts: Social Networks Auto-Poster < 4.4.4 - Subscriber+ Sensitive Information Exposure
Published
2022-10-17
Title
WP < 6.0.3 - Content from Multipart Emails Leaked
Published
2025-11-26
Title
ERP < 1.16.7 - Authenticated (Subscriber+) Information Exposure