漏洞标题
N/A
漏洞描述信息
WordPress 上的 WooCommerce abandonment cart Lite 插件在版本 5.14.2 及以上时存在认证绕过风险。这源于在插件中通过 abandoned cart 链接解码时提供的用户加密强度不足。这允许未验证的 attackers 以已废弃的购物车用户身份登录，这些用户通常是客户。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
认证机制不恰当
漏洞标题
N/A
漏洞描述信息
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
WordPress Plugin Abandoned Cart Lite for WooCommerce 安全漏洞
漏洞描述信息
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin Abandoned Cart Lite for WooCommerce 5.14.2及之前版本存在安全漏洞。攻击者利用该漏洞以abandoned the cart的用户身份登录。
CVSS信息
N/A
漏洞类别
其他