Vulnerability · Published Apr 3, 2023 · Assigned by WPScan

CVE-2023-1124Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI

High 7.2

In plain English

A high-severity security flaw in Shopping Cart & eCommerce Store from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.1%top 34.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Shopping Cart & eCommerce Store	0 – before 5.4.3

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511c exploit, vdb-entry, technical-description