CVE-2023-3365

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0.74% chance of exploitation in the next 30 days, 52th percentile

Published

2023-08-07

Updated

2024-10-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/21ce5baa-8085-4053-8d8b-f7d3e2ae70c1

References

• CVE Record
• NVD entry

Related

• CVE-2023-3364
• CVE-2023-33656
• CVE-2023-33629
• CVE-2023-33657
• CVE-2023-33626
• CVE-2023-33659