Threats tagged 'ghsa-9jf2-8pgm-w9wm'

The WATI Chat and Notification WordPress plugin through version 1.1.8 exposes a public endpoint that does not require a valid, non-empty secret to access the stored API token. An unauthenticated attacker can exploit this to retrieve the API token and then use it on a second public endpoint to obtain sensitive WooCommerce order information, including customer names, addresses, phone numbers, and email addresses. These endpoints are accessible by default and only become restricted after connecting a WATI account.