CVE-2015-3302

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.htmlExploit, Issue Tracking, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535396/100/1100/threaded
http://www.securityfocus.com/bid/74395Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/36860/Exploit, Issue Tracking, Third Party Advisory, VDB Entry
https://www.htbridge.com/advisory/HTB23254Exploit, Issue Tracking, Third Party Advisory
http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.htmlExploit, Issue Tracking, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535396/100/1100/threaded
http://www.securityfocus.com/bid/74395Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/36860/Exploit, Issue Tracking, Third Party Advisory, VDB Entry
https://www.htbridge.com/advisory/HTB23254Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Dec 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-330610.0The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.CVE-2015-33077.5The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attacker CVE-2015-33087.5Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly ha CVE-2015-33097.5Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files wi CVE-2015-33104.3Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is gr CVE-2015-33139.8SQL injection vulnerability in WordPress Community Events plugin before 1.4.CVE-2015-33148.1SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.CVE-2015-33157.8Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files CVE-2015-33164.6CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2;CVE-2015-33174.6CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2;CVE-2015-33184.6CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2;CVE-2015-33195.0Hotspot Express hotEx Billing Manager 73 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attacke