Vulnerabilities

TI-2023-03928 CVE-2023-4242 · GHSA-7rj5-723h-386q

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check

LOW 21

The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00539 Published 2023-08-09 No fix listed CWE-287

TI-2023-03929 CVE-2023-4243 · GHSA-f723-pfg4-v3p5

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation

MEDIUM 42

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.009 Published 2023-08-09 No fix listed CWE-285

Vulnerabilities

Filters

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation