Eshipper Commerce
Monthly
SQL injection in the eShipper Commerce WordPress plugin (versions 2.16.13 and earlier) allows subscriber-level authenticated attackers to issue malicious queries against the underlying WordPress database, with scope extending beyond the plugin's own tables due to the CVSS scope-changed flag (S:C), exposing high-confidentiality data such as customer PII, order records, and potentially hashed credentials. The 'Subscriber' designation in the CVE title maps to the lowest default WordPress user role, meaning any registered site user is a viable attacker without elevated privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
eShipper Commerce plugin versions up to 2.16.12 allow unauthenticated attackers to modify data through missing authorization checks on access control enforcement points. The vulnerability exposes WordPress sites running this e-commerce plugin to unauthorized state changes without requiring authentication, with a low EPSS exploitation probability (0.02% percentile 4%) suggesting limited real-world attack incentive despite the network-accessible attack vector.
SQL injection in the eShipper Commerce WordPress plugin (versions 2.16.13 and earlier) allows subscriber-level authenticated attackers to issue malicious queries against the underlying WordPress database, with scope extending beyond the plugin's own tables due to the CVSS scope-changed flag (S:C), exposing high-confidentiality data such as customer PII, order records, and potentially hashed credentials. The 'Subscriber' designation in the CVE title maps to the lowest default WordPress user role, meaning any registered site user is a viable attacker without elevated privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
eShipper Commerce plugin versions up to 2.16.12 allow unauthenticated attackers to modify data through missing authorization checks on access control enforcement points. The vulnerability exposes WordPress sites running this e-commerce plugin to unauthorized state changes without requiring authentication, with a low EPSS exploitation probability (0.02% percentile 4%) suggesting limited real-world attack incentive despite the network-accessible attack vector.