Vulnerability Description
The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'get_item', 'get_order_notes' and 'add_order_note' functions in versions up to, and including, 1.5.3. This makes it possible for authenticated attackers with subscriber privileges or above, to view the order details and order notes, and add order notes.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wclovers | Woocommerce Multivendor Marketplace | <= 1.5.3 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/wcfm-marketplace-rest-api/tags/1.5.3/Patch
- https://plugins.trac.wordpress.org/browser/wcfm-marketplace-rest-api/tags/1.5.3/Patch
- https://plugins.trac.wordpress.org/browser/wcfm-marketplace-rest-api/tags/1.5.3/Patch
- https://plugins.trac.wordpress.org/changeset/2904331/Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b0520601-7e5c-412d-a8dThird Party Advisory
- https://plugins.trac.wordpress.org/browser/wcfm-marketplace-rest-api/tags/1.5.3/Patch
- https://plugins.trac.wordpress.org/browser/wcfm-marketplace-rest-api/tags/1.5.3/Patch
- https://plugins.trac.wordpress.org/browser/wcfm-marketplace-rest-api/tags/1.5.3/Patch
- https://plugins.trac.wordpress.org/changeset/2904331/Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b0520601-7e5c-412d-a8dThird Party Advisory
FAQ
What is CVE-2023-2275?
CVE-2023-2275 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'get_item', 'get_orde...
How severe is CVE-2023-2275?
CVE-2023-2275 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-2275?
Check the references section above for vendor advisories and patch information. Affected products include: Wclovers Woocommerce Multivendor Marketplace.