Description

WordPress Plugin TheCartPress eCommerce Shopping Cart is prone to a security bypass vulnerability because the application fails to properly check user credentials. An attacker can exploit this issue to obtain sensitive information which may help in launching further attacks. WordPress Plugin TheCartPress eCommerce Shopping Cart version 1.1.9.2 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.2.0 or latest

References

http://ceriksen.com/2012/06/20/wordpress-thecartpress-plugin-order-information-security-bypass/

http://secunia.com/advisories/49652/

Related Vulnerabilities

Joomla! Core 1.5.x Multiple SQL Injection Vulnerabilities (1.5.0 - 1.5.21)

Microsoft SQL Server CVE-2023-21528 Vulnerability (CVE-2023-21528)

XWiki Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2022-23619)

WordPress Plugin NextCellent Gallery-NextGEN Legacy Cross-Site Scripting (1.9.27)

Oracle HTTP Server Improper Restriction of XML External Entity Reference Vulnerability (CVE-2018-20843)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass CWE-264