Shiptime
Monthly
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.
Missing authorization in ShipTime: Discounted Shipping Rates WordPress plugin (versions ≤1.1.1) allows unauthenticated remote attackers to access sensitive shipping rate information and configuration via incorrectly configured access control, resulting in limited confidentiality compromise. CVSS 5.3 with 0.02% EPSS indicates low real-world exploitation probability despite network-accessible attack vector. CISA SSVC framework rates this as non-exploited with partial technical impact, suggesting this is a configuration weakness rather than an actively weaponized vulnerability.
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.
Missing authorization in ShipTime: Discounted Shipping Rates WordPress plugin (versions ≤1.1.1) allows unauthenticated remote attackers to access sensitive shipping rate information and configuration via incorrectly configured access control, resulting in limited confidentiality compromise. CVSS 5.3 with 0.02% EPSS indicates low real-world exploitation probability despite network-accessible attack vector. CISA SSVC framework rates this as non-exploited with partial technical impact, suggesting this is a configuration weakness rather than an actively weaponized vulnerability.