Wpc Shop As A Customer For Woocommerce
Monthly
Authenticated privilege escalation in WPC Shop as a Customer for WooCommerce (versions up to and including 2.0.0) enables any logged-in user to take over an Administrator account by supplying the Administrator's user ID to the wpcsa_login endpoint, receiving a full Administrator session cookie without the Administrator's password. The flaw stems from missing role validation (CWE-269) before issuing a session, and WordPress user IDs are trivially enumerable. No public exploit code is identified at time of analysis, but the vendor-released patch 2.0.1 is available and this is assessed as a genuine high-priority vulnerability.
Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.2.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated privilege escalation in WPC Shop as a Customer for WooCommerce (versions up to and including 2.0.0) enables any logged-in user to take over an Administrator account by supplying the Administrator's user ID to the wpcsa_login endpoint, receiving a full Administrator session cookie without the Administrator's password. The flaw stems from missing role validation (CWE-269) before issuing a session, and WordPress user IDs are trivially enumerable. No public exploit code is identified at time of analysis, but the vendor-released patch 2.0.1 is available and this is assessed as a genuine high-priority vulnerability.
Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.2.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.