CVE-2023-3365

MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment

Affected

MultiParcels Shipping For WooCommerce

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0.74% chance of exploitation in the next 30 days, 54th percentile

Published

2023-08-07

Updated

2024-10-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/21ce5baa-8085-4053-8d8b-f7d3e2ae70c1

References

• CVE Record
• NVD entry