CVE-2023-2275mediumCWE-862

CVE-2023-2275: medium-severity vulnerability in wclovers WCFM – Multivendor Marketplace REST…

WooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API

Published · Updated

Follow this CVE+ Monitor WCFM – Multivendor Marketplace REST API for WooCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.5%
The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'get_item', 'get_order_notes' and 'add_order_note' functions in versions up to, and including, 1.5.3. This makes it possible for authenticated attackers with subscriber privileges or above, to view the order details and order notes, and add order notes.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected products
wclovers · WCFM – Multivendor Marketplace REST API for WooCommerce
Related CVEs — wclovers WCFM – Multivendor Marketplace REST…

In the same product, most dangerous first.

CVE-2025-1311MEDIUMWooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%