CVE-2023-1124

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Unknown	Shopping Cart & eCommerce Store	< 5.4.3

References

https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511cExploit, Third Party Advisory
https://wpscan.com/vulnerability/229b93cd-544b-4877-8d9f-e6debda9511cExploit, Third Party Advisory

Timeline

Published: Apr 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-11256.5The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allo CVE-2023-11265.4The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, s CVE-2023-11277.8Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.CVE-2023-11296.5The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowi CVE-2023-11309.8A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects a CVE-2023-11316.1A vulnerability has been found in SourceCodester Computer Parts Sales and Inventory System 1.0 and classified as problematic. This vulnerabi CVE-2023-11327.5Compiler removal of buffer clearing in sli_se_driver_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key CVE-2023-11339.8Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on por CVE-2023-11348.8Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an atta CVE-2023-11357.8In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which could re CVE-2023-11367.5In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would CVE-2023-11378.8Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and