Description
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Classified Listing | < 5.3.9 | 5.3.9 |
References
- https://wpscan.com/vulnerability/5b720785-86a4-4610-83cb-8cc998d90ccf/ exploit vdb-entry technical-description