WordPress CVEs

Description

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to.

Affected WordPress components

• Quick View For Woocommerce Plugin · quick-view-for-woocommerce
  Possible match Active
  Up to and including 2.2.17
  View on WordPress.org
• Quick View For WooCommerce Plugin · woo-quick-view
  Possible match Active
  Up to and including 2.2.17
  View on WordPress.org
• Quick View for WooCommerce Plugin · wrapcoder-quick-view-for-woocommerce
  Possible match Abandoned
  Up to and including 2.2.17
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• shapedplugin Quick View for WooCommerce — Up to and including 2.2.17

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3402213%40woo-quickview&new=3402213%40woo-quickview&sfp_email=&sfph_mail=
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/809472d5-1698-42da-b414-1dda40983a6e?source=cve
• nvd.nist.gov Official NVD record