CVE-2021-4355

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-435506.5The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which CVE-2021-435515.4A remote attacker with write access to PI Vision could inject code into a display. Unauthorized information disclosure, modification, or del CVE-2021-435525.5The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Informati CVE-2021-435534.3PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and i CVE-2021-435547.8FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to an out-of-bounds write while processing project files, which may allow an CVE-2021-435557.8mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vul CVE-2021-435567.8FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files, which may a CVE-2021-435577.5The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request UR CVE-2021-435586.1A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in th CVE-2021-435598.8A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related b CVE-2021-43569.8The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, CVE-2021-435605.3A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capabili