CVE-2015-3302 TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Sensitive Information Disclosure
HighCVSS 7.5
EPSS 22.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thecartpress ecommerce shopping cart | <= 1.3.9 | No fix listed |
| wordpress thecartpress(WordPress) | <= 1.5.3.6 | No fix listed |
References
- packetstormsecurity.com exploit issue-tracking third-party-advisory vdb-entry
- 20150429 Multiple Vulnerabilities in TheCartPress WordPress plugin mailing-list
- 74395 third-party-advisory vdb-entry
- 36860 exploit issue-tracking third-party-advisory vdb-entry
- www.htbridge.com exploit issue-tracking third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org