Codeatoz B2B Suite For Woocommerce
Monthly
Unauthenticated information disclosure in CodeAtoZ B2B Suite for WooCommerce before 1.6.1 allows remote attackers to retrieve other guests' submitted quotes, including buyer names, email addresses, and requested line items, by supplying an enumerable identifier. No authentication or user interaction is required, and publicly available exploit code exists, though the EPSS score is only 0.18% (7th percentile). This is a moderate-severity issue (CVSS 5.3) with impact limited to confidentiality of quote data, and no active exploitation has been confirmed (not in CISA KEV).
Unauthenticated information disclosure in CodeAtoZ B2B Suite for WooCommerce before 1.6.1 allows remote attackers to retrieve other guests' submitted quotes, including buyer names, email addresses, and requested line items, by supplying an enumerable identifier. No authentication or user interaction is required, and publicly available exploit code exists, though the EPSS score is only 0.18% (7th percentile). This is a moderate-severity issue (CVSS 5.3) with impact limited to confidentiality of quote data, and no active exploitation has been confirmed (not in CISA KEV).