CVE-2024-2384
WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure
- State
- Published
- Severity
- 4.3 Medium
- Published
- Mar 20, 2024
- Updated
- Apr 8, 2026
- Reserved
- Mar 11, 2024
Description
The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | Wordfence |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
WCPOS – Point of Sale (POS) plugin for WooCommercekilbot |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.