CVE-2024-12253: CWE-862 Missing Authorization in nshowketgmailcom Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the plugins settings and retrieve order and log data (which is also accessible to unauthenticated users).
AI Analysis
Technical Summary
CVE-2024-12253 is a missing authorization vulnerability (CWE-862) in the Simple Ecommerce Shopping Cart Plugin for WordPress by nshowketgmailcom. The plugin fails to enforce capability checks on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions, allowing authenticated users with subscriber-level privileges or higher to modify plugin settings and access order and log data. This vulnerability affects all versions up to 3.1.2. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity but not availability.
Potential Impact
An attacker with subscriber-level access or higher can exploit this vulnerability to change plugin settings and access sensitive order and log data. This could lead to unauthorized disclosure of customer information and potential manipulation of ecommerce configurations. The impact is limited to confidentiality and integrity with no direct availability impact. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users. Review plugin settings and logs for unauthorized changes.
CVE-2024-12253: CWE-862 Missing Authorization in nshowketgmailcom Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
Description
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the plugins settings and retrieve order and log data (which is also accessible to unauthenticated users).
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-12253 is a missing authorization vulnerability (CWE-862) in the Simple Ecommerce Shopping Cart Plugin for WordPress by nshowketgmailcom. The plugin fails to enforce capability checks on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions, allowing authenticated users with subscriber-level privileges or higher to modify plugin settings and access order and log data. This vulnerability affects all versions up to 3.1.2. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity but not availability.
Potential Impact
An attacker with subscriber-level access or higher can exploit this vulnerability to change plugin settings and access sensitive order and log data. This could lead to unauthorized disclosure of customer information and potential manipulation of ecommerce configurations. The impact is limited to confidentiality and integrity with no direct availability impact. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users. Review plugin settings and logs for unauthorized changes.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-12-05T16:16:34.458Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6e33b7ef31ef0b597a1b
Added to database: 2/25/2026, 9:48:35 PM
Last enriched: 4/9/2026, 7:21:24 PM
Last updated: 4/12/2026, 9:20:53 AM
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.