Skip to main content

Wp Easycart CVE-2023-1124

HIGH
Files or Directories Accessible to External Parties (CWE-552)
2023-04-03 contact@wpscan.com
Path Traversal Information Disclosure WordPress Wp Easycart
7.2
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 03, 2023 - 15:15 nvd
HIGH 7.2

DescriptionNVD

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.

AnalysisAI

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-552. The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks. Affected products include: Wpeasycart Wp Easycart. Version information: before 5.4.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Wp Easycart

View all
CVE-2014-9308 MEDIUM POC
6.5 Jan 15

Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor
CVE-2015-2673 HIGH POC
8.8 Oct 06

The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyC
CVE-2014-4942 MEDIUM POC
5.0 Jul 11

The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information
CVE-2026-32422 HIGH
8.5 Mar 13

WP EasyCart versions 5.8.13 and earlier are vulnerable to blind SQL injection, allowing authenticated attackers to execu
CVE-2026-57765 HIGH
8.5 Jul 02

SQL injection in the WP EasyCart WordPress e-commerce plugin (all versions up to and including 5.9.0) lets a low-privile
CVE-2023-3023 HIGH
7.2 Jul 12

The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions u
CVE-2023-2891 MEDIUM
6.5 Jun 09

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8
CVE-2023-2892 MEDIUM
6.5 Jun 09

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8
CVE-2023-2894 MEDIUM
4.3 Jun 09

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8
CVE-2023-2896 MEDIUM
4.3 Jun 09

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8
CVE-2023-2895 MEDIUM
4.3 Jun 09

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8
CVE-2023-2893 MEDIUM
4.3 Jun 09

The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8

Same weakness CWE-552 – Files or Directories Accessible to External Parties

View all
CVE-2016-3715 MEDIUM POC
5.5
CVE-2017-16651 HIGH POC
7.8
CVE-2023-6266 HIGH POC
7.5
CVE-2021-22015 HIGH POC
7.8
CVE-2017-14942 CRITICAL POC
9.8
CVE-2015-5211 CRITICAL POC
9.6
CVE-2020-37082 CRITICAL POC
9.8
CVE-2024-53676 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2023-1124 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy