CVE-2024-1688: CWE-862 Missing Authorization in shivashankerbhatta Woo Total Sales
The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_orders_archive() function in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to retrieve sales reports for the store.
AI Analysis
Technical Summary
The Woo Total Sales plugin for WordPress suffers from a missing capability check in the get_orders_archive() function in all versions up to 3.1.4. This lack of authorization verification permits unauthenticated users to retrieve sales reports, leading to unauthorized data disclosure. The vulnerability is tracked as CVE-2024-1688 and is classified under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed.
Potential Impact
An attacker can obtain sales report data from the affected Woo Total Sales plugin without authentication, resulting in unauthorized disclosure of potentially sensitive business information. There is no impact on data integrity or availability reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin or disable it if possible to prevent unauthorized data exposure.
CVE-2024-1688: CWE-862 Missing Authorization in shivashankerbhatta Woo Total Sales
Description
The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_orders_archive() function in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to retrieve sales reports for the store.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Woo Total Sales plugin for WordPress suffers from a missing capability check in the get_orders_archive() function in all versions up to 3.1.4. This lack of authorization verification permits unauthenticated users to retrieve sales reports, leading to unauthorized data disclosure. The vulnerability is tracked as CVE-2024-1688 and is classified under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed.
Potential Impact
An attacker can obtain sales report data from the affected Woo Total Sales plugin without authentication, resulting in unauthorized disclosure of potentially sensitive business information. There is no impact on data integrity or availability reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin or disable it if possible to prevent unauthorized data exposure.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-02-20T20:30:42.804Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6d39b7ef31ef0b56f1b0
Added to database: 2/25/2026, 9:44:25 PM
Last enriched: 4/9/2026, 1:44:51 PM
Last updated: 4/12/2026, 6:18:39 PM
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.