WordPress Colissimo shipping methods for WooCommerce 授权问题漏洞

暂无

WordPress Colissimo shipping methods for WooCommerce是WordPress基金会的一款为WooCommerce提供法国Colissimo物流配送方式集成与运费计算的配送插件。 WordPress Colissimo shipping methods for WooCommerce 2.9.0及之前版本存在授权问题漏洞，该漏洞源于updateShippingMethod()函数缺少权限检查，可能导致已通过身份验证的攻击者（具有订阅者级别及以上权限）修改任意WooCommerce订单的配送信息（配送方式、取件点元数据和配送地址）。

链接:https://plugins.trac.wordpress.org/browser/colissimo-shipping-methods-for-woocommerce/tags/2.9.0/admin/orders/lpc_admin_order_affect.php#L52 链接:https://plugins.trac.wordpress.org/browser/colissimo-shipping-methods-for-woocommerce/tags/2.9.0/admin/orders/lpc_admin_order_affect.php#L84 链接:https://plugins.trac.wordpress.org/browser/colissimo-shipping-methods-for-woocommerce/tags/2.9.0/admin/orders/lpc_admin_order_affect.php#L85 链接:https://plugins.trac.wordpress.org/changeset?reponame=&old=3553367%40colissimo-shipping-methods-for-woocommerce&new=3553367%40colissimo-shipping-methods-for-woocommerce 链接:https://www.wordfence.com/threat-intel/vulnerabilities/id/16041d22-51ff-4fa4-99fb-20a60b557634?source=cve