CVE-2023-3365 - MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

Back Back to CVE browser

HIGH

MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

Published Aug 7, 2023

8.1

HIGH

CVSS 3.1

EPSS 0.74%

Description

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment

Affected products

Vendor n/a Product MultiParcels Shipping For WooCommerce Default
unaffected
Affected
- ≥ 0, < 1.14.14

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	MultiParcels Shipping For WooCommerce	unaffected	Affected ≥ 0, < 1.14.14

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44032
Advisory
https://wpscan.com/vulnerability/21ce5baa-8085-4053-8d8b-f7d3e2ae70c1
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44032		Advisory
https://wpscan.com/vulnerability/21ce5baa-8085-4053-8d8b-f7d3e2ae70c1		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Aug 7, 2023

Updated Oct 10, 2024

Reserved Jun 22, 2023

Link CVE-2023-3365

CISA Vulnrichment

Updated Oct 10, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-3365

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Aug 7, 2023

Updated Oct 10, 2024

Link EUVD-2023-44032

GitHub

No data