Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Order Data Disclosure
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.2%
exploitation probability
0.2%top 89% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Order Sync with Zendesk for WooCommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/8c8ca8ff-e0e8-4e9c-b79b-7f95816a9113/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.