CVE-2023-2275

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'get_item', 'get_order_notes' and 'add_order_note' functions in versions up to, and including, 1.5.3. This makes it possible for authenticated attackers with subscriber privileges or above, to view the order details and order notes, and add order notes.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-227509.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted pCVE-2023-227519.8There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-227529.8There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-227539.8There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code eCVE-2023-227549.8There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code eCVE-2023-227559.8There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code eCVE-2023-227569.8There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code eCVE-2023-227579.8There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code eCVE-2023-227587.2Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of theseCVE-2023-227597.2Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of theseCVE-2023-22769.8The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object ReferCVE-2023-227607.2Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these
CVE-2023-2275: Medium severity, CVSS 5.4 | Vulnix