Vulnerability · Published May 2, 2022 · Assigned by WPScan
CVE-2021-25002Tipsacarrier < 1.5.0.5 - Unauthenticated Orders Disclosure
High 7.5
In plain English
A high-severity missing authorization in Tipsacarrier from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.5%top 25.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Tipsacarrier | 1.5.0.5 – before 1.5.0.5 |
Weakness: CWE-862