CVE-2021-4355: Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the downloadorderdetaillist(), changeorderlist(), and downloadmemberlist() functions called via admininit hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-4355?
CVE-2021-4355 is a vulnerability in the Welcart e-Commerce plugin for WordPress that allows authorization bypass due to missing capability checks on certain functions.
What is the severity of CVE-2021-4355?
CVE-2021-4355 has a severity keyword of 'high' and a severity value of 5.3.
Which software versions are affected by CVE-2021-4355?
Versions up to and including 2.2.7 of the Welcart e-Commerce plugin for WordPress are affected by CVE-2021-4355.
How can I fix CVE-2021-4355?
To fix CVE-2021-4355, you should update the Welcart e-Commerce plugin for WordPress to version 2.2.8 or later.
Where can I find more information about CVE-2021-4355?
You can find more information about CVE-2021-4355 at the following references: [1] https://blog.nintechnet.com/wordpress-welcart-e-commerce-plugin-fixed-vulnerabilities/ [2] https://www.wordfence.com/threat-intel/vulnerabilities/id/671f5ba5-1f18-49fa-aa97-eaebdb3417bb?source=cve