Flexible Shipping Ups Vulnerabilities

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_oauth_data function in all versions up to, and including, 2.3.12. This makes it possible for authenticated attackers, with Subscriber-level...

CVSS:

4.3

Affected:

up to 2.3.12

Fixed in:

3.0.0

Disclosed:

Oct 24, 2024

CVE-2024-9109 on NVD →

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.4. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknow...

CVSS:

4.3

Affected:

up to 2.2.4

Fixed in:

2.2.5

Disclosed:

Apr 11, 2024

CVE-2024-31944 on NVD →