Threats tagged 'ghsa-j2wh-22m9-2pv6'

The Email Templates Customizer and Designer for WordPress and WooCommerce plugin is vulnerable to an authorization bypass in all versions up to and including 1.5.14. This flaw allows unauthenticated attackers to enumerate WooCommerce order IDs and exfiltrate customers' billing information, including names, addresses, phone numbers, and email addresses. The exploit requires two unauthenticated requests involving nonce harvesting and order ID submission to the preview endpoint, enabling full customer PII disclosure without credentials.