Faktur Pro For Woocommerce
Monthly
Insecure direct object reference in the Faktur Pro for WooCommerce WordPress plugin (all versions up to and including 3.2.1) allows an authenticated WooCommerce customer to read other customers' invoice and order data by substituting a different user's object identifier in a request that fails to enforce per-user ownership checks. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): exploitation is remote and low-complexity but requires a legitimate low-privileged customer account, and the confirmed impact is limited to confidentiality (high) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is further bounded by the plugin's niche deployment and the authentication precondition - anonymous visitors cannot trigger it.
Insecure direct object reference in the Faktur Pro for WooCommerce WordPress plugin (all versions up to and including 3.2.1) allows an authenticated WooCommerce customer to read other customers' invoice and order data by substituting a different user's object identifier in a request that fails to enforce per-user ownership checks. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): exploitation is remote and low-complexity but requires a legitimate low-privileged customer account, and the confirmed impact is limited to confidentiality (high) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is further bounded by the plugin's niche deployment and the authentication precondition - anonymous visitors cannot trigger it.