Wc Ukraine Shipping
Monthly
Insecure Direct Object Reference (IDOR) in the WC Ukraine Shipping WordPress plugin versions 1.22.3 and earlier allows subscriber-level authenticated users to access and partially modify shipping and order objects belonging to other customers. Reported by Patchstack and classified CWE-639, the flaw arises from the plugin resolving shipping or order records via user-supplied identifiers without verifying the authenticated session owner is authorized to access that resource. With a CVSS 7.1 score carrying C:H/I:L impact, successful exploitation can expose customer PII, order histories, and shipping records; no public exploit or active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the WC Ukraine Shipping WordPress plugin versions 1.22.3 and earlier allows subscriber-level authenticated users to access and partially modify shipping and order objects belonging to other customers. Reported by Patchstack and classified CWE-639, the flaw arises from the plugin resolving shipping or order records via user-supplied identifiers without verifying the authenticated session owner is authorized to access that resource. With a CVSS 7.1 score carrying C:H/I:L impact, successful exploitation can expose customer PII, order histories, and shipping records; no public exploit or active exploitation has been identified at time of analysis.