WordPress Sendcloud Shipping Plugin Broken Access Control Advisory

Vulnerability Overview Vulnerability Name: Broken Access Control in WordPress Sendcloud Shipping Plugin <= 1.0.29 Priority: Low Impact: No significant impact Vulnerability Type: Broken Access Control Description: Lack of authorization, authentication, or nonce token checks, which may allow unauthenticated users to perform higher-privileged operations. Affected Scope Affected Versions: <= 1.0.29 Software Type: WordPress Plugin Vulnerability Tags: Broken Access Control Remediation Current Status: No official patch available Recommended Measures: Immediately update the affected plugin. If updating is not possible, contact your hosting provider or web developer for assistance. Additional Information Reporter: Nguyen Ba Khanh Report Date: February 10, 2020 Early Warning Sent Date: July 2, 2020 Public Disclosure Date: July 2, 2020 Risk Description Risk Level: Low Risk Description: Such vulnerabilities are typically used in large-scale attack campaigns. Attackers can leverage these vulnerabilities to target tens of thousands of websites, regardless of their traffic size or popularity. Solution Solution: This security issue has minimal impact and is unlikely to be exploited. Detailed Information Software: Sendcloud Shipping Type: Plugin Affected Versions: <= 1.0.29 Vulnerability Tags: Broken Access Control Timeline Reporter: Nguyen Ba Khanh Report Date: February 10, 2020 Early Warning Sent Date: July 2, 2020 Public Disclosure Date: July 2, 2020 Frequently Asked Questions How does Patchstack provide the fastest protection? How does Patchstack mitigate vulnerabilities? Why do hackers target my website? What should I do if my website has already been compromised? Subscription Subscription: Weekly WordPress security intelligence delivered to your inbox. --- Note: No POC code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Sendcloud Shipping Plugin Broken Access Control Advisory