Critical Flaw Found in WordPress Plugin for WooCommerce Used by 30,000 Websites

A critical security flaw has been disclosed in the WordPress “Abandoned Cart Lite for WooCommerce” plugin that’s mounted on additional than 30,000 web-sites.

“This vulnerability makes it probable for an attacker to gain entry to the accounts of end users who have deserted their carts, who are generally shoppers but can lengthen to other significant-stage buyers when the proper disorders are met,” Defiant’s Wordfence explained in an advisory.

Tracked as CVE-2023-2986, the shortcoming has been rated 9.8 out of 10 for severity on the CVSS scoring procedure. It impacts all versions of the plugin, like and prior to versions 5.14.2.

The difficulty, at its main, is a situation of authentication bypass that occurs as a end result of inadequate encryption protections that are applied when prospects are notified when they have abandoned their purchasing carts on e-commerce internet sites without having completing the purchase.

Particularly, the encryption key is difficult-coded in the plugin, thereby permitting malicious actors to login as a consumer with an deserted cart.

“Even so, there is a prospect that by exploiting the authentication bypass vulnerability, an attacker can achieve entry to an administrative person account, or one more increased-stage person account if they have been tests the deserted cart features,” security researcher István Márton said.

Next accountable disclosure on May perhaps 30, 2023, the vulnerability was dealt with by the plugin developer, Tyche Softwares, on June 6, 2023, with version 5.15.. The recent model of Abandoned Cart Lite for WooCommerce is 5.15.2.

The disclosure will come as Wordfence revealed yet another authentication bypass flaw impacting StylemixThemes’ “Reserving Calendar | Appointment Booking | BookIt” plugin (CVE-2023-2834, CVSS score: 9.8) that has around 10,000 WordPress installs.

“This is due to insufficient verification on the person getting provided through scheduling an appointment through the plugin,” Márton spelled out. “This helps make it possible for unauthenticated attackers to log in as any existing user on the web page, these kinds of as an administrator, if they have access to the email.”

The flaw, affecting variations 2.3.7 and before, has been tackled in version 2.3.8, which was produced on June 13, 2023.

Observed this report appealing? Observe us on Twitter  and LinkedIn to read extra exclusive articles we put up.

Some parts of this article are sourced from:
thehackernews.com