CVE-2021-4375 — Missing Authorization in Welcart E-commerce

CWE-862 — Missing Authorization3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 77.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Uscnanbu Welcart E-commerceWelcart E-commerce
Timeline
PublishedJun 7

Description

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information() function in versions up to, and including, 2.2.7. This makes it possible for authenticated attackers to download information including WordPress settings, plugin settings, PHP settings and server settings.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5uscnanbu/welcart_e-commerce< 2.2.8

🔴Vulnerability Details

2
CVEList
Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure↗2023-06-07
▶
GHSA
GHSA-6gxh-65cm-hw36: The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_infor↗2023-06-07
▶
CVE-2021-4375 — Missing Authorization | cvebase