Threats tagged 'ghsa-3h33-w3fj-rp34'

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress up to version 2.3.11 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can access sensitive WooCommerce payment gateway credentials, including PayPal API credentials and Stripe secret keys, exposed in the raw HTML response of the tour edit screen. These credentials are accessible regardless of the modal's CSS visibility, making them easily retrievable by viewing the page source.