Threats tagged 'ghsa-pv7m-mp6r-762j'

The Order Tracking WordPress plugin versions prior to 3.6.2 have a vulnerability where the plugin does not verify that a visitor owns the customer or sales representative account for which order information is requested. Account numbers are sequential by default, enabling unauthenticated users to access the order history of any customer or sales representative, including order contact email addresses in some versions.