Descrição
The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers- uploaded payment receipts, that they do not own.
CVSS 5.3EPSS 0.23500000000000001%Risco 0.54
Ver fonte- Publicação
- 2026-08-06 07:16:27
- Última alteração
- 2026-08-06 15:16:42
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N