CVE-2021-25002

The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.50% chance of exploitation in the next 30 days, 72th percentile

Published

2022-05-02

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b14f476e-3124-4cbf-91b4-ae53c4dabd7c

References

• CVE Record
• NVD entry

Related

• CVE-2021-25001
• CVE-2021-25003
• CVE-2021-25000
• CVE-2021-25004
• CVE-2021-24999
• CVE-2021-25005