Information disclosure in Discount Rules for WooCommerce - #VU46871

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in "sers_list" AJAX action. A remote authenticated attacker can gain unauthorized access to sensitive information on the system, such as list (userid and username only) of all users.

Affected software

Remediation

External References

• https://wpvulndb.com/vulnerabilities/10409/
• https://www.wordfence.com/blog/2020/09/high-severity-vulnerabilities-patched-in-discount-rules-for-woocommerce/
• https://www.webarxsecurity.com/multiple-vulnerabilities-in-discount-rules-for-woocommerce-plugin/

Related Security Bulletins

• Multiple vulnerabilities in Discount Rules for WooCommerce plugin for WordPress