Description
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ShinyStat Analytics | 1.0.12 – < 1.0.17 | 1.0.17 |
References
- https://wpscan.com/vulnerability/cac3a0c4-e6b9-42a6-b702-abcba67038c2/ exploit vdb-entry technical-description