Integration For Epos Now And Woocommerce
Monthly
Unauthenticated information disclosure in the WordPress plugin Integration for Epos Now and WooCommerce (versions 4.6.0 through 4.11.1) lets any remote visitor who can reach an unprotected REST endpoint read the site's scheduled background tasks together with their stored arguments, exposing WooCommerce order identifiers and, under narrower conditions, the plaintext passwords of newly registered customers queued for WooCommerce's deferred-emails feature. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but the high attack complexity reflects two dependencies: WooCommerce's deferred-emails option must be enabled, and a freshly registered customer's email task must still be present in the scheduled-task queue when the request is made. Publicly available exploit code exists and vendor patch 4.11.2 is available; exploitation has not been confirmed in the wild, and the practical blast radius is limited by the conditional nature of the password exposure.
Unauthenticated information disclosure in the WordPress plugin Integration for Epos Now and WooCommerce (versions 4.6.0 through 4.11.1) lets any remote visitor who can reach an unprotected REST endpoint read the site's scheduled background tasks together with their stored arguments, exposing WooCommerce order identifiers and, under narrower conditions, the plaintext passwords of newly registered customers queued for WooCommerce's deferred-emails feature. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but the high attack complexity reflects two dependencies: WooCommerce's deferred-emails option must be enabled, and a freshly registered customer's email task must still be present in the scheduled-task queue when the request is made. Publicly available exploit code exists and vendor patch 4.11.2 is available; exploitation has not been confirmed in the wild, and the practical blast radius is limited by the conditional nature of the password exposure.