Description
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Product Delivery Date for WooCommerce | < 3.3.2 | 3.3.2 |
References
- https://wpscan.com/vulnerability/d7310c1a-f858-4dc5-8102-813fb64096a6/ exploit vdb-entry technical-description