Critical Flaw Found in WordPress Plugin for WooCommerce Used by 30,000 Websites

A critical security flaw has been disclosed in the WordPress “Deserted Cart Lite for WooCommerce” plugin which is mounted on extra than 30,000 sites.

“This vulnerability makes it possible for an attacker to gain accessibility to the accounts of consumers who have deserted their carts, who are normally consumers but can lengthen to other high-stage people when the appropriate situations are met,” Defiant’s Wordfence mentioned in an advisory.

Tracked as CVE-2023-2986, the shortcoming has been rated 9.8 out of 10 for severity on the CVSS scoring procedure. It impacts all versions of the plugin, like and prior to versions 5.14.2.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The challenge, at its main, is a scenario of authentication bypass that occurs as a consequence of inadequate encryption protections that are applied when buyers are notified when they have deserted their buying carts on e-commerce internet sites without having finishing the purchase.

Especially, the encryption crucial is tricky-coded in the plugin, therefore allowing destructive actors to login as a consumer with an abandoned cart.

“However, there is a chance that by exploiting the authentication bypass vulnerability, an attacker can obtain accessibility to an administrative person account, or another greater-degree consumer account if they have been screening the abandoned cart operation,” security researcher István Márton reported.

Adhering to responsible disclosure on May 30, 2023, the vulnerability was addressed by the plugin developer, Tyche Softwares, on June 6, 2023, with variation 5.15.. The latest edition of Deserted Cart Lite for WooCommerce is 5.15.2.

The disclosure comes as Wordfence revealed yet another authentication bypass flaw impacting StylemixThemes’ “Scheduling Calendar | Appointment Reserving | BookIt” plugin (CVE-2023-2834, CVSS rating: 9.8) that has in excess of 10,000 WordPress installs.

“This is thanks to insufficient verification on the consumer getting provided during scheduling an appointment by way of the plugin,” Márton stated. “This will make it doable for unauthenticated attackers to log in as any current person on the web page, such as an administrator, if they have obtain to the email.”

The flaw, impacting variations 2.3.7 and previously, has been tackled in version 2.3.8, which was introduced on June 13, 2023.

Found this short article exciting? Abide by us on Twitter  and LinkedIn to read extra exclusive information we submit.