Description
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Security For WooCommerce | ≤ 1.0.16 | — |
References
- https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/ exploit vdb-entry technical-description