CVE-2023-6897

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6897
The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpfactory:ean_for_woocommerce:*:*:*:*:*:wordpress:*:*
History

11 Feb 2025, 20:31

Type Values Removed Values Added
First Time Wpfactory ean For Woocommerce
Wpfactory
CPE cpe:2.3:a:wpfactory:ean_for_woocommerce:*:*:*:*:*:wordpress:*:*
References () https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce - () https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=cve - Third Party Advisory
CWE CWE-639

21 Nov 2024, 08:44

Type Values Removed Values Added
Summary
  • (es) El complemento EAN para WooCommerce para WordPress es vulnerable a Insecure Direct Object Reference en todas las versiones hasta la 4.9.2 incluida a través del código corto 'alg_wc_ean_product_meta' debido a la falta de validación en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, expongan metadatos de publicaciones potencialmente confidenciales.
References () https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce - () https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=cve -

18 Apr 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-18 11:15

Updated : 2025-02-11 20:31

NVD link : CVE-2023-6897

Mitre link : CVE-2023-6897

CVE.ORG link : CVE-2023-6897

JSON object : View

Products Affected

wpfactory

  • ean_for_woocommerce
CWE
CWE-639

Authorization Bypass Through User-Controlled Key