Description
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MultiParcels Shipping For WooCommerce | < 1.14.14 | 1.14.14 |
References
- https://wpscan.com/vulnerability/21ce5baa-8085-4053-8d8b-f7d3e2ae70c1 exploit vdb-entry technical-description