zorem vulnerabilities and threats

The Customer Email Verification for WooCommerce plugin for WordPress contains an authentication bypass vulnerability in all versions up to 2.8.2. The flaw arises from a predictable email-verification token and lack of proper capability or nonce checks in the authentication function. This allows unauthenticated attackers to log in as verified WooCommerce customers or mark existing accounts as verified, bypassing email verification controls. Exploitation depends on the presence of a specific database schema column from older plugin versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through <= 4.0.

Missing Authorization vulnerability in zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.6.2.

Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.6.1.