Wpzoom Connect
Monthly
Sensitive customer data disclosure in WPZOOM Connect through 4.7.3 allows an authenticated low-privilege WooCommerce customer/subscriber to retrieve full customer card data for any arbitrary victim email, including names, WordPress user IDs, order histories, totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts. The issue is caused by the 'x-yamidoo-signature' printed by inline_js() being forgeable: an attacker registers a crafted email whose local part encodes the target timestamp and victim email, making verify_request() accept the signature; share_customer_data and identify_logged_in are enabled by default, so no non-default configuration is required. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity/availability impact, and no public exploit code or CISA KEV active exploitation was identified at time of analysis.
Sensitive customer data disclosure in WPZOOM Connect through 4.7.3 allows an authenticated low-privilege WooCommerce customer/subscriber to retrieve full customer card data for any arbitrary victim email, including names, WordPress user IDs, order histories, totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts. The issue is caused by the 'x-yamidoo-signature' printed by inline_js() being forgeable: an attacker registers a crafted email whose local part encodes the target timestamp and victim email, making verify_request() accept the signature; share_customer_data and identify_logged_in are enabled by default, so no non-default configuration is required. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity/availability impact, and no public exploit code or CISA KEV active exploitation was identified at time of analysis.