CVE-2024-13558CWE-639

NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure

High · published March 20, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the content of quote requests.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00374 · 30.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-03-20T11:11Z
EPSS history
Timeline
  • 20 MAR 11:11Z
    NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
    cvelistv5